CVE-2026-91742 in Chrome
Summary
by MITRE • 09/16/2026
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as Confused Deputy in the PriceTracking feature of Google Chrome on iOS represents a significant class of privilege escalation flaws where an application or script is tricked into performing actions on behalf of another entity without proper authorization checks. In this specific instance, prior to version 153.0.8010.47, the flaw allowed remote attackers who leveraged social engineering techniques to bypass system access restrictions and gain entry into privileged pages within the browser environment. This type of vulnerability is fundamentally rooted in a failure by the software to correctly verify that it has sufficient permissions for an action before executing it, often due to ambiguous trust boundaries between different components or contexts within the application architecture. The core technical flaw lies in how Chrome handled network traffic and state management during price tracking operations, where crafted requests could exploit ambiguities in identity verification mechanisms. By manipulating these interactions, an attacker could trick the browser into treating untrusted input as trusted system-level commands or data access tokens, effectively elevating their privileges within the application sandbox to access sensitive user information or modify protected settings that should remain inaccessible to standard web content.
From a technical perspective, this vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically focusing on cases where an actor is granted more permissions than necessary for its intended function. The operational impact of such a flaw extends beyond simple data leakage; it compromises the integrity and confidentiality of user sessions by allowing unauthorized access to privileged interfaces that are typically shielded from web-based attacks. When combined with social engineering tactics, the risk amplifies significantly because the initial vector relies on deceiving the end-user into initiating or interacting with malicious network traffic. This could involve convincing a user to visit a specially crafted website or click a link that triggers the vulnerable code path in Chrome’s price tracking module. Once triggered, the attacker can exploit the confused deputy condition to execute actions within the browser context as if they were part of the trusted system layer, potentially leading to session hijacking, credential theft, or further exploitation of other vulnerabilities present on the device.
The classification by Chromium security severity as Medium reflects the balance between the complexity required to exploit the flaw and its potential impact. While it does not allow for direct remote code execution without user interaction, the ability to bypass access restrictions into privileged pages poses a serious threat to user privacy and account security. This scenario is also relevant to MITRE ATT&CK techniques such as T1078 Valid Accounts, where attackers use legitimate credentials or system permissions obtained through deception to move laterally or escalate privileges within an environment. Additionally, the reliance on crafted network traffic highlights aspects of T1566 Phishing, emphasizing that technical vulnerabilities are often most dangerous when paired with human-centric attack vectors. The confusion arises because the application fails to distinguish between requests originating from trusted internal components and those coming from external sources, leading it to process maliciously formatted data as legitimate administrative commands.
Mitigation for this vulnerability primarily involves updating Google Chrome on iOS to version 153.0.8010.47 or later, where the developers have addressed the underlying logic errors in the PriceTracking module that allowed for these privilege bypasses. Security patches typically involve tightening input validation, enforcing stricter origin checks, and ensuring that sensitive operations require explicit user consent or higher-level authentication proofs before execution. For organizations deploying Chrome across devices, it is critical to enforce automatic update policies to ensure all endpoints are protected against such exploits. Furthermore, users should be educated on the risks of interacting with untrusted web content, particularly when prompted by social engineering attempts designed to trigger specific browser features like price tracking or shopping assistants. Implementing strict Content Security Policies and utilizing browser hardening techniques can also reduce the attack surface available to attackers attempting to leverage similar confused deputy conditions in other applications. Regular security audits focusing on privilege boundaries and identity verification logic are essential for preventing recurrence of such architectural flaws in future software releases.