CVE-2026-79217: Chrome iOS Auth Bypass Vulnerability

CVE-2026-79217 Overview

CVE-2026-79217 is an incorrect authorization vulnerability in Google Chrome for iOS. Versions prior to 152.0.7977.65 fail to properly enforce system access restrictions in the Mobile component. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to bypass access controls that Chrome should enforce on iOS.

Google classified the Chromium security severity as Medium. The weakness is tracked under CWE-863: Incorrect Authorization.

Critical Impact
A remote attacker can bypass system access restrictions on iOS Chrome users by luring them to a crafted HTML page, undermining browser-enforced authorization boundaries.

Affected Products

Google Chrome on iOS prior to 152.0.7977.65
Chromium-based Mobile component on iOS
Downstream distributions bundling the vulnerable Chrome iOS build

Discovery Timeline

2026-08-25 - CVE-2026-79217 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79217

Vulnerability Analysis

The flaw resides in the Mobile component of Chrome on iOS. Chrome performs an authorization check that is either incomplete or applied to the wrong actor before granting access to a system-level capability. An attacker who controls page content can structure HTML that reaches the code path where the check is missing or bypassable. The browser then proceeds as if the request were authorized.

Because the vulnerability is reachable from web content, no local privileges or user credentials are required. The victim only needs to render attacker-controlled HTML in Chrome for iOS. See the Chromium Issue Tracker entry 514055709 and the Chrome Stable channel release notes for vendor-side technical details.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] within Chrome iOS Mobile code. The authorization logic does not correctly validate the origin, context, or capability request before allowing a restricted operation. This class of flaw typically arises when a check trusts client-supplied state, omits a policy branch, or applies an insufficient comparison to security-relevant identifiers.

Attack Vector

Exploitation is remote and content-driven. An attacker hosts a crafted HTML page, then directs a user to open it in Chrome on iOS through phishing, malvertising, or a compromised site. When the page loads, embedded markup or script triggers the vulnerable code path and bypasses system access restrictions the browser should enforce.

No verified proof-of-concept code is public. Refer to the Chromium Issue Tracker entry for technical specifics as they become available.

Detection Methods for CVE-2026-79217

Indicators of Compromise

Chrome for iOS clients reporting a version string below 152.0.7977.65 in mobile device management (MDM) inventory.
Web traffic from managed iOS devices to newly registered or low-reputation domains hosting HTML payloads shortly before anomalous device behavior.
Unexpected access to restricted iOS resources or capabilities correlated with Chrome browsing sessions.

Detection Strategies

Query MDM and unified endpoint management (UEM) inventories for the installed Chrome iOS build and flag versions prior to 152.0.7977.65.
Correlate web proxy or DNS logs with device telemetry to identify users who visited suspicious HTML pages on vulnerable Chrome iOS builds.
Hunt for iOS crash logs or app anomalies from com.google.chrome.ios following external navigation events.

Monitoring Recommendations

Ingest MDM software inventory, mobile web proxy logs, and iOS device telemetry into a central analytics platform for version and behavior correlation.
Alert when a managed iOS device runs a Chrome build below the patched version after the enforcement deadline.
Track outbound requests to phishing infrastructure that targets mobile browsers.

How to Mitigate CVE-2026-79217

Immediate Actions Required

Update Google Chrome on iOS to version 152.0.7977.65 or later through the Apple App Store on every managed device.
Push a mandatory update policy through MDM or UEM to enforce the patched Chrome iOS build.
Notify users of the update requirement and confirm compliance through inventory reporting.

Patch Information

Google addressed the vulnerability in Chrome for iOS 152.0.7977.65. Review the Chrome Stable channel update announcement for the official release notice and consult the Chromium Issue Tracker entry 514055709 for issue metadata.

Workarounds

Direct iOS users to an alternate, fully patched browser until Chrome for iOS is updated.
Block navigation to untrusted or unrated domains from managed iOS devices using a secure web gateway.
Enforce user-awareness reminders to avoid opening unsolicited links on mobile devices during the remediation window.

bash

# Verify Chrome iOS version compliance across managed devices (pseudo-MDM query)
mdm query --platform ios --app com.google.chrome.ios --field version \
  | awk '$2 < "152.0.7977.65" {print $1, $2, "NON-COMPLIANT"}'