CVE-2026-106189 in Chrome
Summary
by MITRE • 10/06/2026
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as CVE-2024-6789 represents a significant code injection flaw within the Reader Mode feature of Google Chrome for iOS, specifically affecting versions prior to 155.0.8059.39. This security defect stems from an improper neutralization of special elements used in web pages, which allows malicious actors to inject arbitrary script content into a webpage that is being processed by the browser's reader view engine. The core technical flaw lies in how Chrome parses and sanitizes HTML content when transitioning standard browsing mode to Reader Mode. Instead of strictly stripping or escaping potentially dangerous scripting tags and event handlers, the parser fails to adequately validate input against expected safe patterns, thereby permitting execution of injected code within the context of the original page's origin. This failure constitutes a classic instance of CWE-79, commonly known as Cross-Site Scripting (XSS), specifically manifesting through improper output neutralization for scripts.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics to achieve exploitation. Because the attack vector requires user interaction, such as clicking a link or opening a crafted HTML page that triggers Reader Mode, it does not allow for fully automated remote code execution without some form of deception. However, once triggered, the attacker can bypass web origin policies due to the way Reader Mode processes content. By injecting scripts into the reader view context, an adversary can potentially access sensitive data stored in cookies or local storage associated with the victim's current session on that specific domain. This capability enables unauthorized actions such as account takeover, credential theft, or manipulation of user interactions under the guise of the legitimate website, effectively undermining the security boundaries established by the Same-Origin Policy which is designed to prevent malicious scripts from accessing data from other domains.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of web-based attacks where JavaScript serves as the vehicle for exploitation. The attack path typically involves crafting an HTML page that exploits the parsing logic in Reader Mode to execute malicious payloads upon activation. This scenario highlights the risks associated with browser features designed for readability or distraction-free viewing, which may inadvertently introduce new surface areas for injection if input validation is not rigorously enforced across all rendering modes. The Chromium security team has classified this issue as Medium severity, reflecting its potential impact on data confidentiality and integrity while acknowledging the requirement for user interaction to facilitate exploitation.
To mitigate the risks associated with this vulnerability, users must ensure that their Google Chrome application on iOS is updated to version 155.0.8059.39 or later, where these parsing flaws have been addressed through enhanced sanitization routines and stricter validation of input data within Reader Mode. For organizations deploying managed browsers, it is advisable to enforce automatic update policies to minimize the window of exposure. Additionally, security awareness training should emphasize caution when interacting with links from untrusted sources, particularly those that might trigger specific browser features like Reader Mode unexpectedly. Implementing Content Security Policy headers on web applications can also provide an additional layer of defense by restricting the execution environment for scripts, although this mitigation is dependent on proper configuration and may not fully protect against all variants of injection flaws in third-party extensions or specialized modes like Reader View if they operate outside standard CSP enforcement scopes.