CVE-2026-106414
published 2026-10-06CVE-2026-106414: Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially…
PriorityP354critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.34%
26.0th percentile
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 155.0.8059.39 | 155.0.8059.39 | |
| chrome | >= 155.0.8059.39 < 155.0.8059.39 | 155.0.8059.39 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
vendor_paloalto·2026-10-14·CVSS 9.6
CVE-2026-85042 [CRITICAL] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-de
Red Hat
chromium-browser: Improper input validation in Mobile
vendor_redhat·2026-10-06·CVSS 9.6
CVE-2026-106414 [CRITICAL] CWE-20 chromium-browser: Improper input validation in Mobile
chromium-browser: Improper input validation in Mobile
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A flaw was found in Google Chrome on iOS. Improper input validation allows a remote attacker to achieve arbitrary code execution outside the application sandbox. By using social engineering to convince a user to visit a specially crafted HTML page, an attacker can exploit this vulnerability to execute unauthorized code on the device.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-106414
vendor_chrome·2026-10-06·CVSS 9.6
CVE-2026-106414 [MEDIUM] Stable Channel Update for Desktop: CVE-2026-106414
Stable Channel Update for Desktop
CVE-2026-106414: Improper input validation in Mobile. Reported by Google on 2026-04-19 [N/A][ 504227656 ] Medium CVE-2026-106408: Protection mechanism failure in Mobile
Reported by Google on 2026-04-19 [N/A][ 504638005 ] Medium CVE-2026-106261: Uninitialized resource in Video
Severity: medium
VulDB
Google Chrome up to 154.0.8037.97 input validation
vuldb·2026-10-07·CVSS 9.6
CVE-2026-106414 [CRITICAL] Google Chrome up to 154.0.8037.97 input validation
A vulnerability identified as critical has been detected in Google Chrome. This affects an unknown function. This manipulation causes improper input validation.
The identification of this vulnerability is CVE-2026-106414. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox
ghsa_unreviewed·2026-10-06
CVE-2026-106414 [CRITICAL] CWE-20 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
2026-10-06
Published