Google Chrome for iOS, Universal Cross-Site Scripting (UXSS), CVE-2026-17761 (Medium) -DC-Aug2026-1318

By /

Listen to this Post

How CVE-2026-17761 Works

CVE-2026-17761 is a medium-severity universal cross-site scripting (UXSS) vulnerability affecting Google Chrome on iOS versions prior to 151.0.7922.72. The root cause lies in insufficient validation of untrusted input within the iOS browser’s network traffic processing pipeline.
Unlike traditional reflected or stored XSS, UXSS allows an attacker to bypass the Same-Origin Policy (SOP) entirely. This means the injected scripts are not confined to the attacker’s own origin but can execute within the context of any website the victim visits after the initial compromise.
The attack vector is remote and network-based – the attacker does not need to trick the user into clicking a malicious link or visiting a compromised site directly. Instead, they can inject malicious payloads via specially crafted network traffic that the Chrome for iOS browser processes. This could be achieved through:
– Man-in-the-Middle (MitM) attacks on unencrypted or weakly encrypted connections.
– Malicious proxy servers or compromised Wi-Fi networks that inject hostile data into HTTP responses.
– Malicious advertisements or third-party scripts that manipulate network-level data flows.
When the browser receives and parses this untrusted network data, the lack of proper input sanitization allows the attacker’s JavaScript or HTML to be injected into the DOM of any page that is subsequently loaded or rendered. Because the injection occurs at the browser’s network layer, it affects all origins, making it a universal cross-site scripting flaw.
Once executed, the injected script has full access to the page’s DOM, cookies, localStorage, and session tokens, enabling the attacker to steal sensitive information, perform actions on behalf of the user, and pivot to other websites without additional user interaction. The vulnerability is remotely exploitable and requires no user interaction beyond normal browsing activity.
Google assigned a Chromium security severity of Medium and the CVSS v3.1 base score is 5.4 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The EPSS score is 0.002, indicating a low probability of active exploitation in the wild.

DailyCVE Form

Platform: Google Chrome iOS
Version: < 151.0.7922.72
Vulnerability: UXSS via network
Severity: Medium (5.4)
Date: 2026-07-30

Prediction: 2026-07-29

What Undercode Say

Analytics & Telemetry

  • Attack Surface: Network-layer input parsing in Chrome for iOS
  • Exploitability: Remote, no user interaction required for initial injection
  • Prerequisite: Attacker must control or influence network traffic (e.g., MitM, rogue proxy)
  • Affected Users: All Chrome for iOS users running versions below 151.0.7922.72
  • Patch Status: Fixed in Chrome 151.0.7922.72 (stable channel update released July 2026)
  • CWE: CWE-20 (Improper Input Validation)

Bash Commands & Validation

Check current Chrome for iOS version (via device settings or enterprise MDM)
For macOS/iOS connected devices, use ideviceinfo or similar tools
Example: Query Apple's App Store API for Chrome version
curl -s "https://itunes.apple.com/lookup?bundleId=com.google.chrome.ios" | jq '.results[bash].version'
Verify if device is running a vulnerable version
CHROME_VERSION="151.0.7922.72"
INSTALLED_VERSION=$(defaults read /Applications/Google\ Chrome.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "unknown")
if [[ "$INSTALLED_VERSION" < "$CHROME_VERSION" ]]; then
echo "VULNERABLE: Upgrade to $CHROME_VERSION or later"
else
echo "PATCHED: Version $INSTALLED_VERSION"
fi

Network Traffic Injection Test (Conceptual)

PoC snippet: Intercept HTTP response and inject malicious script
(Requires MitM position; for educational purposes only)
import scapy.all as scapy
def inject_payload(packet):
if packet.haslayer(scapy.Raw):
payload = packet[scapy.Raw].load
if b"<html" in payload or b"<body" in payload:
malicious = b'<script>alert("UXSS-CVE-2026-17761");</script>'
packet[scapy.Raw].load = payload.replace(b"<body>", malicious + b"<body>")
return packet
Apply in-line on network interface (requires root)
scapy.sniff(iface="en0", prn=inject_payload, store=0)

Exploit

An attacker positioned on the network path (e.g., rogue Wi-Fi, poisoned DNS, compromised CDN) can inject arbitrary HTML/JavaScript into any HTTP response that the Chrome for iOS browser processes. Because the browser fails to validate this untrusted input, the injected script is rendered and executed within the context of the target page, bypassing the Same-Origin Policy.

Exploitation Steps:

  1. Position – Attacker gains MitM capability on the victim’s network.
  2. Intercept – Monitor HTTP traffic from the victim’s Chrome for iOS browser.
  3. Inject – Insert malicious `
    Scroll to Top