CVE-2026-106192 in Chrome
Summary
by MITRE • 10/06/2026
Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as an information leak within the mobile implementation of Google Chrome for iOS, specifically affecting versions prior to 155.0.8059.39, represents a significant privacy and security concern despite its classification by Chromium with a low severity rating. This flaw stems from improper handling or exposure of sensitive data stored locally on the device, which can be accessed by an attacker who has achieved physical access to the target iOS device. In mobile environments, local attackers are those who have unlocked the device or bypassed basic screen locks, allowing them direct interaction with the operating system and installed applications without requiring remote network exploitation vectors. The core technical flaw involves Chrome failing to adequately restrict access to certain internal states, cached data, or configuration files that contain user-sensitive information such as browsing history, saved passwords, session tokens, or autofill data when accessed through local application interfaces or file systems exposed during debugging or specific app lifecycle events.
From a technical perspective, this vulnerability likely exploits weaknesses in the sandboxing mechanisms or permission models inherent to how Chrome manages its internal storage on iOS. While Apple’s iOS provides robust security features such as App Sandbox and Data Protection APIs, applications can sometimes inadvertently expose data through improper file permissions, insecure local database handling, or by leaving sensitive artifacts accessible after a user has logged out or closed sessions. The attacker leverages physical access to navigate the device's file system or utilize debugging tools that are often available on jailbroken devices or via enterprise provisioning profiles to read these unprotected resources. This allows for the extraction of data that should remain isolated within the application’s secure container, effectively bypassing the intended isolation boundaries designed to protect user privacy against local threats.
The operational impact of this vulnerability is primarily centered around confidentiality and privacy rather than system integrity or availability. An attacker with physical access can harvest sensitive personal information, including login credentials for various web services, private browsing history that reveals user interests or locations, and potentially session cookies that could be used to hijack active sessions if they remain valid. This poses a severe risk in scenarios where devices are shared, lost, stolen, or accessed by unauthorized individuals such as malicious insiders or opportunistic thieves. Although the severity is rated low due to the requirement for physical access, which acts as a significant barrier for most remote attackers, the potential for identity theft and credential stuffing attacks remains high if the extracted data is comprehensive enough to compromise multiple accounts.
To mitigate this risk, users are strongly advised to update Google Chrome on iOS immediately to version 155.0.8059.39 or later, where these information disclosure flaws have been addressed through improved access controls and stricter enforcement of sandboxing rules. Beyond software updates, device owners should ensure that their iOS operating system is also up to date to benefit from the latest security patches related to file system permissions and app isolation. Additionally, implementing strong screen lock mechanisms such as complex passcodes or biometric authentication can reduce the window of opportunity for local attackers who rely on physical access to exploit this vulnerability. Enabling two-factor authentication on all critical accounts further mitigates the impact should sensitive credentials be compromised, ensuring that possession of static passwords alone is insufficient for unauthorized account access.
This incident aligns with Common Weakness Enumeration (CWE) categories such as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-798: Use of Hard-coded Credentials if applicable to the specific implementation details, highlighting a failure in proper data protection mechanisms. In terms of adversary tactics, this vulnerability supports techniques associated with MITRE ATT&CK Mobile Adversary Tactics, specifically T1530: Data from Local System, where attackers retrieve files and directories from compromised devices for later exfiltration or analysis. Understanding these mappings helps security professionals categorize the threat correctly within broader defense frameworks and prioritize remediation efforts based on the likelihood of physical access scenarios in their specific operational environments.