CVE-2026-121050 in Chrome
Summary
by MITRE • 11/03/2026
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CVE-2024-6967 represents a race condition within the mobile implementation of Google Chrome on iOS, specifically affecting versions prior to 157.0.8103.38. This flaw resides in the browser's handling of web origin policies, which are fundamental security mechanisms designed to isolate content from different origins to prevent malicious scripts on one page from accessing sensitive data or actions performed by another site. The core technical issue stems from a timing discrepancy during the processing of cross-origin requests and resource loads. When a crafted HTML page is loaded, it can exploit this race condition to manipulate the browser's internal state before the origin check is fully completed or enforced. By carefully orchestrating the sequence of events through asynchronous operations, an attacker can cause the browser to incorrectly associate resources with a trusted origin rather than their actual source, effectively bypassing the Same-Origin Policy restrictions that are critical for maintaining web application security boundaries.
From a technical perspective, this vulnerability aligns closely with CWE-362, which describes concurrent execution errors where shared resources are accessed without proper synchronization. In the context of browser engines like Blink, race conditions often occur when multiple threads or asynchronous callbacks interact with global state variables that track origin permissions or resource loading status. If the check for cross-origin access is not atomic relative to the request initiation, an attacker can inject malicious payloads into contexts where they should be blocked. The Chromium security team classified this issue as Low severity because while it allows for policy bypass, the practical exploitation requires a highly specific and crafted HTML page that must be loaded by the victim. This limits the scope of potential attacks compared to more critical vulnerabilities such as remote code execution or sandbox escapes, yet it still poses a significant risk to users who may inadvertently visit maliciously constructed sites designed to steal session cookies, read sensitive DOM content, or perform actions on behalf of the user in other open tabs.
The operational impact of this vulnerability is primarily centered around data exfiltration and unauthorized access within the browser environment. An attacker leveraging this flaw could potentially retrieve private information from websites that the victim has authenticated with, provided those sites do not implement additional protective measures like strict Content Security Policies or anti-CSRF tokens. This bypass undermines the trust model of the web by allowing a malicious origin to read data intended for a different origin. While the attack vector is remote and requires user interaction in the form of visiting a crafted page, the ease with which modern browsers can be tricked into executing such scripts makes this a persistent threat. The impact is particularly relevant on mobile devices where users often have multiple tabs open across various banking, email, and social media platforms, increasing the potential surface area for data leakage if one tab is compromised via this race condition.
To mitigate the risks associated with CVE-2024-6967, it is imperative to update Google Chrome on iOS to version 157.0.8103.38 or later immediately upon availability. This patch addresses the synchronization issues within the origin checking logic, ensuring that cross-origin requests are validated before any resources are loaded or accessible. For organizations deploying mobile devices, enforcing automatic browser updates through Mobile Device Management solutions is recommended to ensure all endpoints remain protected against such timing-based exploits. Additionally, developers of web applications should continue to implement robust security headers and adhere to OWASP guidelines for preventing unauthorized data access. While the patch resolves the underlying race condition in the browser engine, maintaining a defense-in-depth strategy remains essential as new vulnerabilities may emerge that target similar architectural components within modern web browsers.