Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149

CVE-2026-11202 is a client-side bug in Chrome for iOS that affects versions before 149.0.7827.53. A remote attacker would have to get a user onto a crafted HTML page, then leverage an inappropriate implementation flaw to potentially escape Chrome's internal sandbox boundary inside the iOS app context.

The vendor/NVD-style 8.8 HIGH score overstates enterprise urgency. In the real world this is user-driven, iOS-only, browser-client exploitation with no KEV entry, very low EPSS, no public exploit evidence found, and an Apple-controlled platform model where web-browsing apps must use WebKit and run inside iOS app protections; that sharply reduces exposed population and blast radius compared with a typical desktop-browser RCE.

Why this verdict

• UI-required client-side exploit path: starting from vendor 8.8, I subtract because the attacker needs the victim to open malicious web content; that is materially harder than unauthenticated server reachability.
• iOS-only and Chrome-only population: this is not all browsers and not all mobile devices. Requiring Chrome on iOS sharply narrows the exposed slice of a 10,000-host estate.
• Apple platform containment changes the math: iOS web-browsing apps must use WebKit and operate under iOS app security controls, so a Chrome-internal sandbox escape is still not equivalent to broad OS compromise.
• No exploitation signal: no KEV listing, no public campaign reporting, and a very low EPSS remove the urgency premium that would otherwise keep this in HIGH.
• Per-user blast radius: the realistic enterprise consequence is session theft or browser-context abuse for a subset of users, not mass lateral movement or wormability.

Why not higher?

There is no evidence here of active exploitation, no no-click path, and no exposure model comparable to a perimeter service. The combination of user interaction, mobile-only targeting, and client-app confinement prevents this from deserving a HIGH or CRITICAL response in most enterprises.

Why not lower?

This still starts from a remote attacker with no privileges required, and the bug class is described as a potential sandbox escape, which is not trivial. If a high-value user browses sensitive corporate apps from Chrome on iOS, successful exploitation could still expose sessions or data that matter.

1. Inventory vulnerable app versions — Use MDM or EMM inventory to identify devices running Chrome for iOS < 149.0.7827.53. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but you should still know your population before the next mobile app wave.
2. Force or nudge the App Store update — Push Chrome for iOS 149.0.7827.53+ through your normal managed-mobile update process. There is no noisgate mitigation SLA here; complete the actual app remediation inside the 365-day remediation window, sooner for executive and admin device groups.
3. Prefer managed browser controls — If you already use managed browsing, keep sensitive SaaS access pinned to a managed browser profile and monitor risky-link events. This does not replace patching, but it reduces the chance that a random phishing click turns into an exploitable page load while you work through the normal remediation window.
4. Keep iOS current — Maintain current iOS/iPadOS baselines because Apple platform protections are part of the reason this scored down. This is supporting risk reduction, not a substitute for the Chrome update, and it can ride the same normal mobile maintenance cycle.

Run this on an auditor workstation against an MDM-exported CSV that contains a Chrome-for-iOS version column. Example: python3 check_cve_2026_11202_ios_chrome.py devices.csv chrome_version or python3 check_cve_2026_11202_ios_chrome.py devices.csv AppVersion. No admin privileges are required.

#!/usr/bin/env python3\n# Check Chrome for iOS exposure to CVE-2026-11202 from an MDM CSV export\n# Usage: python3 check_cve_2026_11202_ios_chrome.py devices.csv chrome_version\n# Exit codes:\n#   0 = all rows PATCHED\n#   1 = at least one row VULNERABLE\n#   2 = UNKNOWN (missing/invalid data or mixed unknowns without vulnerable rows)\n\nimport csv\nimport re\nimport sys\nfrom pathlib import Path\n\nFIXED = (149, 0, 7827, 53)\n\ndef parse_version(s):\n    if s is None:\n        return None\n    m = re.search(r'(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)', str(s))\n    if not m:\n        return None\n    return tuple(int(x) for x in m.groups())\n\ndef status_for(version_text):\n    v = parse_version(version_text)\n    if v is None:\n        return 'UNKNOWN'\n    if v < FIXED:\n        return 'VULNERABLE'\n    return 'PATCHED'\n\ndef main():\n    if len(sys.argv) != 3:\n        print('UNKNOWN - usage: python3 check_cve_2026_11202_ios_chrome.py <csv_path> <version_column>')\n        sys.exit(2)\n\n    csv_path = Path(sys.argv[1])\n    version_col = sys.argv[2]\n\n    if not csv_path.exists():\n        print(f'UNKNOWN - file not found: {csv_path}')\n        sys.exit(2)\n\n    vulnerable = 0\n    patched = 0\n    unknown = 0\n    rows = 0\n\n    with csv_path.open(newline='', encoding='utf-8-sig') as f:\n        reader = csv.DictReader(f)\n        if not reader.fieldnames or version_col not in reader.fieldnames:\n            print(f'UNKNOWN - column not found: {version_col}')\n            sys.exit(2)\n\n        id_col = None\n        for candidate in ('device_id', 'Device ID', 'serial', 'Serial Number', 'name', 'Device Name', 'hostname'):\n            if candidate in reader.fieldnames:\n                id_col = candidate\n                break\n\n        for row in reader:\n            rows += 1\n            device = row.get(id_col, f'row-{rows}') if id_col else f'row-{rows}'\n            version_text = row.get(version_col, '')\n            state = status_for(version_text)\n            print(f'{device}: {state} (version={version_text})')\n            if state == 'VULNERABLE':\n                vulnerable += 1\n            elif state == 'PATCHED':\n                patched += 1\n            else:\n                unknown += 1\n\n    if rows == 0:\n        print('UNKNOWN - no data rows found')\n        sys.exit(2)\n\n    print(f'SUMMARY: VULNERABLE={vulnerable} PATCHED={patched} UNKNOWN={unknown}')\n\n    if vulnerable > 0:\n        print('VULNERABLE')\n        sys.exit(1)\n    if unknown > 0:\n        print('UNKNOWN')\n        sys.exit(2)\n\n    print('PATCHED')\n    sys.exit(0)\n\nif __name__ == '__main__':\n    main()\n

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149 security fixes)
2. Google Chrome Releases - Chrome Stable for iOS Update (149.0.7827.45 prior stable)
3. GitHub Advisory Database - GHSA-2x2v-r3mf-2j25 / CVE-2026-11202
4. Vulnerability-Lookup (CIRCL) - CVE-2026-11202 record with EPSS snapshot
5. CISA Known Exploited Vulnerabilities Catalog
6. Apple App Review Guidelines
7. Apple Support - Intro to app security for iOS, iPadOS, and visionOS