CVE-2026-91742: Chrome iOS Authentication Bypass Flaw

CVE-2026-91742 Overview

CVE-2026-91742 is a confused deputy vulnerability in the PriceTracking component of Google Chrome on iOS. Versions prior to 153.0.8010.47 are affected. A remote attacker leveraging social engineering can bypass system access restrictions and reach a privileged page through crafted network traffic. Chromium rates this issue as Medium severity. The weakness is classified under CWE-441: Unintended Proxy or Intermediary (Confused Deputy).

Critical Impact
An attacker can trick the browser into performing privileged navigation on behalf of untrusted content, exposing internal Chrome iOS pages to unauthorized interaction.

Affected Products

Google Chrome on iOS versions prior to 153.0.8010.47
PriceTracking feature component within Chrome for iOS
Downstream Chromium-based iOS builds inheriting the PriceTracking code path

Discovery Timeline

2026-09-15 - CVE-2026-91742 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91742

Vulnerability Analysis

The flaw resides in the PriceTracking feature of Chrome on iOS. PriceTracking is a browser-integrated capability that follows product prices on shopping pages. The component acts on behalf of the user with elevated browser privileges. When it processes crafted network traffic under attacker influence, it can be coerced into invoking privileged navigation logic that untrusted web content should not reach. This behavior matches the confused deputy pattern described by CWE-441, where a privileged intermediary performs actions on behalf of a less-privileged caller.

Successful exploitation requires user interaction driven by social engineering. The attacker must lure the victim into visiting or interacting with an attacker-controlled resource. Once triggered, the bypass exposes an internal, privileged Chrome page that would normally be off-limits to web origins.

Root Cause

The root cause is missing or insufficient validation of the caller context inside the PriceTracking flow. PriceTracking honors requests that should be constrained to trusted internal callers. Because the trust boundary between web content and the privileged surface is not enforced, crafted traffic can pivot into a privileged page.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts or injects content that issues crafted network traffic targeting the PriceTracking component. Social engineering convinces the victim to trigger the flow inside Chrome on iOS. The browser then routes the request through PriceTracking and reaches a privileged internal page.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at publication. The EPSS score is 0.218% at percentile 12.386. Technical details are tracked in the Chromium Issue Tracker entry and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-91742

Indicators of Compromise

Chrome on iOS clients reporting a version string below 153.0.8010.47 in mobile device management (MDM) inventory
Unexpected in-app navigation events to internal chrome:// style privileged pages following visits to unfamiliar shopping or price-comparison domains
Outbound requests to newly registered domains impersonating retail brands paired with Chrome iOS user agents

Detection Strategies

Correlate Chrome iOS version telemetry from MDM with the fixed version 153.0.8010.47 to identify exposed devices
Inspect mobile web proxy logs for crafted responses referencing PriceTracking endpoints from untrusted origins
Flag social engineering lures in email and messaging gateways that direct iOS users to price-tracking or shopping bait pages

Monitoring Recommendations

Enable mobile threat defense telemetry to capture browser navigation anomalies on iOS endpoints
Track Chrome iOS release cadence and alert when managed devices fall behind the current stable channel
Review URL categorization feeds for domains newly observed pushing PriceTracking-related payloads

How to Mitigate CVE-2026-91742

Immediate Actions Required

Update Google Chrome on iOS to version 153.0.8010.47 or later on all managed devices
Push the update through Apple Business Manager or the organization's MDM to enforce compliance
Instruct users to avoid clicking unsolicited shopping or price-tracking links delivered through email, SMS, or messaging apps

Patch Information

Google addressed the issue in Chrome for iOS 153.0.8010.47. Refer to the Google Chrome Stable Update announcement and the Chromium Issue Tracker entry for release details.

Workarounds

Use an alternate browser on iOS until the Chrome update is applied where feasible
Disable or avoid the PriceTracking feature in Chrome on iOS until devices receive the patched build
Apply URL filtering at the network layer to block untrusted shopping domains associated with social engineering campaigns

bash

# Verify Chrome for iOS version compliance via MDM query
# Example: Jamf Pro Smart Group criteria
# App Name: Google Chrome
# App Version: less than 153.0.8010.47
# Action: enforce update to current stable channel