External risk intelligence

Google Chrome iOS Code Execution via Crafted HTML.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-106414

This vulnerability affects a client-side web browser application on iOS. It requires user interaction through social engineering to load a crafted page, meaning it is not a service that is inherently public-facing or reachable without specific user action to navigate to a malicious resource.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Google Chrome on iOS that could allow a remote attacker to execute code outside of the browser's secure environment. This threat is realized through a user being tricked into visiting a malicious web page. The security severity is rated as Medium.

Vulnerability lets attackers run code outside the browser.
Social engineering is needed for exploitation.
Confirm relevance and exposure for iOS users.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would then interact with a vulnerable component in the Chrome browser on iOS. If successful, this could allow the attacker to execute code on the user's device.

Requires a user to visit a malicious page.
Triggered by a crafted HTML page.
Code execution outside the browser sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code outside the sandbox on an affected iOS device when a user is tricked into visiting a malicious HTML page. This could potentially impact the confidentiality, integrity, and availability of the user's device and data.

Arbitrary code execution outside the sandbox.
User visits a crafted HTML page.
Device compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on iOS, likely impacting end-users and the teams responsible for managing their mobile devices and applications. The first practical step is to identify Chrome installations on iOS devices, determine their business criticality, and ascertain which teams manage these devices and the Chrome application. Then, plan remediation based on the identified risk and potential user impact.

Own by Mobile and Application Teams.
Verify Chrome iOS presence and criticality.
Coordinate user-facing updates and guidance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for iOS?

Google Chrome for iOS is the mobile edition of the Chrome web browser designed specifically for Apple's mobile operating system. Unlike versions on other platforms, it is built on the WebKit engine required by iOS. It provides users with core browsing features like synchronization, search, and web navigation while operating within the specific security and resource constraints established by Apple for mobile applications.

What does improper input validation mean for CVE-2026-106414?

This vulnerability is classified as CWE-20, Improper Input Validation. In this context, it means the browser fails to properly check or sanitize the data it receives from a webpage. Because the software does not correctly verify this input, a specially crafted HTML page can cause the browser to behave unexpectedly, potentially allowing the attacker to bypass the security sandbox that normally keeps web content isolated from the rest of the device.

Does just visiting a safe website trigger this vulnerability?

No. The vulnerability is not triggered by standard web browsing or visiting trusted, benign websites. It requires a specific trigger: the user must be successfully manipulated through social engineering to navigate to a malicious, crafted HTML page. If the user does not visit a page specifically designed to exploit this flaw, the browser's insecure behavior remains dormant.

How relevant is this to my organization according to Halo Surface Signal?

Halo Surface Signal identifies this as very unlikely to be a high-risk service exposure. Because Chrome is a client-side application and not a public-facing server, it cannot be reached remotely without active user participation. The threat is contingent on an attacker convincing a user to interact with a malicious resource, rather than the browser being inherently open to automated, background scanning from the internet.

What steps should I take if I use Chrome on iOS?

You should begin by confirming which devices in your environment have Chrome installed and identifying the teams responsible for managing them. Prioritize updates to the version mentioned in the security advisory to ensure the browser's input validation is corrected. Coordinate with mobile device management teams to roll out these updates to end-users to mitigate the risk of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.