CVE-2026-106414: Google Chrome on iOS: Improper Input Validation Allowing Possible Code Execution Outside the Sandbox

Overview

CVE-2026-106414 describes an improper input validation weakness (CWE-20) in the mobile version of Google Chrome on iOS. The description states that a remote attacker using social engineering could potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. The Chromium security severity is listed as Medium, while the record carries a Critical severity label and a CVSS v3 base score of 9.6.

Impact

• The description states that arbitrary code execution outside the sandbox is potentially possible.
• The CVSS vector in the record indicates a network attack that needs no privileges and requires user interaction, with a changed scope and high impact on confidentiality, integrity and availability.
• Real-world impact depends on whether users can be led to open a malicious page, which the record associates with social engineering.

Affected products and versions

• Product: Google Chrome, mobile edition on iOS, according to the description.
• The description places the issue in versions before 155.0.8059.39.
• The structured affected list contains two conflicting entries, so the exact range should be confirmed against the vendor release notes.

Exploitation status

• The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
• The SSVC fields show exploitation as none and automatable as no.
• The EPSS probability is 0.00338 with a percentile of 0.26045, dated 2026-10-23.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Update Google Chrome on iOS to version 155.0.8059.39 or a later build, as indicated by the record and the vendor release notes linked in the references.
• Keep browser updates enabled on managed and personal iOS devices, and verify installed versions through the device management tools used by your organization.
• Reinforce user awareness about unsolicited links and unexpected pages, since the described attack relies on social engineering.

Detection guidance

• Inventory iOS devices and record the installed Chrome version to identify those still before 155.0.8059.39.
• Review reports of unexpected browser crashes or unusual browser behavior on managed devices.
• Correlate user reports of suspicious links with browser activity at a high level, without relying on specific indicators that the sources do not provide.

Limitations of the available information

• The structured fixes list is empty. The fixed version is taken from the description wording and should be verified in the vendor advisory.
• The record has no English title, and the description contains a repeated word in the platform phrase.
• The affected version entries are contradictory.
• The Chromium issue tracker page is marked as permissions required and its contents were not reviewed.
• No technical details or proof-of-concept information are provided, and none are included here.

Frequently asked questions

Is CVE-2026-106414 being actively exploited?

The record is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which version addresses this issue?

The description places the issue in versions before 155.0.8059.39, so updating to 155.0.8059.39 or a later build is the expected remediation. Confirm in the vendor release notes.

Why is the affected range unclear?

The structured affected list contains two conflicting entries, so the exact range should be verified against the vendor advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.