External risk intelligence

Google Chrome iOS Transactions Platform Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-85047

This vulnerability exists within a specific component of the Google Chrome browser on iOS. Browser-based vulnerabilities require a user to navigate to a malicious site or interact with crafted content, which is a client-side interaction rather than an exposed internet-facing service, gateway, or reachable management interface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability identified in the Transactions Platform component of Google Chrome on iOS. The vulnerability stems from improper input validation, which, if exploited through a specially crafted HTML page, could allow a remote attacker to execute code outside the browser's secure sandbox. The potential impact is rated as medium severity by Chromium.

Input validation flaw in Chrome's transaction platform.
May allow code execution outside browser sandbox.
Confirm relevance and exposure for iOS Chrome users.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website. This website would contain specially crafted HTML, which the user's browser would process. If successful, this could allow code to run outside the browser's safe environment, potentially leading to broader system compromise.

User must visit a malicious site.
Specially crafted HTML triggers validation flaw.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A crafted HTML page could allow an attacker to execute arbitrary code outside of the Chrome sandbox on iOS. This could affect user data and service behavior when a user visits a malicious page.

User data and system integrity at risk.
Via crafted HTML page in browser.
Potential for arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Transactions Platform within Google Chrome on iOS. Ownership likely falls to application owners responsible for the Chrome browser, potentially involving coordination with platform or mobile device management teams. The initial practical step is to confirm the presence and reachability of the affected Chrome version across managed iOS devices, identify business-critical usage, and then prioritize remediation based on exposure and impact.

Own by Chrome/browser application owners.
Verify Chrome version and iOS device exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Transactions Platform in Google Chrome on iOS?

The Transactions Platform is a specialized component within the Google Chrome browser architecture designed to manage and process commerce-related activities and payment flows on iOS devices. It functions as an internal browser subsystem that handles sensitive data exchange during online purchasing or financial interactions. Because it is integrated directly into the browser, it relies on strict security controls to ensure that data processed during these transactions remains isolated from the rest of the...

How does improper input validation lead to CVE-2026-85047?

This vulnerability is classified as CWE-20, which occurs when software receives input but fails to verify that it is safe or correctly formatted before processing it. In this specific case, the Transactions Platform does not properly filter the data provided by an HTML page. Because the browser assumes the input is trustworthy, it inadvertently allows the code to bypass standard security boundaries, potentially enabling execution outside of the browser's protected sandbox environment.

Does viewing any website trigger this vulnerability?

No. The flaw is not triggered simply by opening the browser or navigating to standard, legitimate websites. An attacker must specifically craft a malicious HTML page designed to exploit the validation error. If the page does not contain this specific, malicious payload, the Transactions Platform will process the content normally, and the vulnerability will not be triggered.

Why does Halo Surface Signal label this as unlikely to be internet-facing?

Halo Surface Signal identifies this as a client-side risk because it resides within a browser component on a user's mobile device, not an exposed server, gateway, or management port. Since the threat depends on a user actively navigating to a malicious URL, it lacks the characteristics of a traditional internet-facing service that an attacker could scan and compromise remotely without any direct user interaction or navigation.

What is the first step to address this Chrome vulnerability?

To protect your environment, begin by auditing your mobile device fleet to identify which units are running the affected version of Google Chrome on iOS. Once identified, ensure that these devices are updated to the latest available version provided by the vendor. Coordinate with your mobile device management teams to verify that users are on patched releases, as updating the application is the primary method to resolve the underlying input validation error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.