CVE-2026-95295 in Chrome
Summary
by MITRE • 09/29/2026
Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an information leak within the mobile component of Google Chrome for iOS represents a significant privacy risk, particularly when devices are accessible by unauthorized individuals with physical proximity. This flaw existed in versions prior to 154.0.8037.57 and stemmed from improper handling or exposure of sensitive data stored locally on the device. In modern web browsers, local storage mechanisms such as IndexedDB, localStorage, cookies, and cached resources often contain highly personal information including authentication tokens, session identifiers, form autofill data, browsing history, and potentially credentials if auto-login features are enabled. The specific nature of this leak suggests that an attacker with physical access to the device could bypass standard security controls or exploit a misconfiguration in how Chrome isolates its sandboxed environment from other applications or system-level processes on iOS.
From a technical perspective, mobile operating systems like iOS employ strict app sandboxing to prevent one application from accessing another's data without explicit permission. However, vulnerabilities can arise when an application fails to properly restrict access to its local storage files during certain states of operation, such as when the device is locked but not fully suspended, or through improper use of shared containers and keychain items that are accessible under specific conditions. An attacker leveraging physical access might exploit this by connecting the device to a malicious peripheral, using accessibility features improperly configured by the user, or exploiting edge cases in the browser's data persistence layer where sensitive strings were written to disk without adequate encryption or access control checks. This allows for the extraction of plaintext or weakly protected data that should remain confidential even if the physical hardware is compromised.
The operational impact of this vulnerability is severe due to the principle of least privilege being violated through unauthorized local disclosure. If an attacker gains read access to Chrome's internal storage, they can harvest session cookies and authentication tokens, effectively hijacking active user sessions without needing a password or biometric bypass for every action. This facilitates account takeover attacks across web services where the user is currently logged in. Furthermore, exposure of autofill data such as addresses, phone numbers, and partial credit card information compromises personal privacy and can lead to identity theft or financial fraud. The severity rating of Medium from Chromium reflects that while the attack requires physical access which acts as a natural barrier for many users, the potential consequences are high because mobile devices are frequently carried in public spaces where opportunistic attacks are feasible.
This incident aligns with CWE-200 Information Exposure and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor within standard vulnerability classification frameworks. It also relates to ATT&CK techniques involving Local Data Staging or Collection, specifically how attackers might leverage physical access to extract data from local storage mechanisms on mobile devices. To mitigate such risks, users must ensure their browsers are updated to the latest stable versions where these sandboxing and isolation flaws have been patched by Google's security team. Additionally, enabling strong device-level encryption and passcodes is critical, as it ensures that even if file system access is achieved, the underlying data remains cryptographically protected. Organizations should enforce mobile device management policies that require up-to-date applications and restrict physical access to corporate-owned devices to minimize the attack surface for local information leakage vulnerabilities.