Description

Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:14.603Z",
  "pubdate": "2026-08-25T21:18:14.603Z",
  "executiveSummary": "A vulnerability exists in Google Chrome on iOS that facilitates an unauthorized information leak concerning stored credentials. Classified by Chromium as having a Low security severity, this flaw permits a local attacker to access sensitive password data.\nThe vulnerability resides within the password management component of the browser. To exploit this flaw, an attacker must possess local access to the target device and utilize a specifically crafted file to trigger the disclosure. The impact is primarily localized to the compromise of stored user credentials within the application's environment. Successful exploitation requires the presence of the vulnerable software version and the deployment of a malicious file on the host operating system. As this is a local attack vector, the threat actor's capabilities are limited to individuals with physical or logical access to the iOS device file system, emphasizing the necessity of maintaining updated software to protect sensitive authentication data from local extraction.",
  "technicalDetails": "The vulnerability is identified as an information disclosure flaw originating from improper handling of data within the Google Chrome password management module on the iOS platform. The root cause pertains to a deficiency in the browser's internal logic when parsing or interacting with specific file types, allowing a local actor to circumvent intended sandbox protections or access control mechanisms to read sensitive credential store contents.\nExploitation follows a specific attack flow: First, the attacker must successfully place a crafted file into a directory accessible by the Chrome application or otherwise reachable through an application-level file handler. This file is architected to leverage the vulnerability during the browser's processing or indexing stage. Upon the browser's interaction with the malicious file, the password management component fails to enforce secure boundaries, causing the application to disclose protected password information to the attacker's process or an insecure log file.\nThe vulnerable component is the password handling service, which manages the local storage and retrieval of credentials. Versions of Google Chrome on iOS prior to 152.0.7977.65 are susceptible to this flaw. Because the vulnerability requires the attacker to introduce a crafted file onto the device, it necessitates local access, precluding a remote, network-based exploitation scenario. No elevated privileges beyond those of a standard user interacting with the file system are required, provided the attacker can place the payload in the appropriate path.\nPost-exploitation, the primary impact is the unauthorized retrieval of sensitive authentication material. The attacker can exfiltrate passwords stored within the Chrome password manager, potentially leading to the compromise of secondary accounts and services associated with those credentials. This vulnerability highlights the risks associated with local file processing in browsers, where secondary files may be interpreted in ways that allow for unauthorized access to internal memory or secure storage caches. By crafting a file that forces the application into an erroneous state during data ingestion, the attacker successfully triggers the leakage of memory or disk contents containing sensitive strings or structured password data, effectively bypassing the browser's intended security architecture."
}