Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149

CVE-2026-11272 is an input-validation flaw in Reading List for Google Chrome on iOS affecting versions before 149.0.7827.53. The vulnerable path is not generic web browsing; the attacker has to get untrusted content into the Reading List workflow and then rely on the victim to perform the right in-app actions so Chrome processes attacker-controlled data there. On iOS, that usually means browser-context script/HTML injection, spoofing, or policy bypass inside the app rather than a straight device compromise.

The vendor's 8.8/HIGH score reads like a broadly reachable browser exploit, but the real-world path is much tighter. This is Chrome on iPhone/iPad only, it needs user interaction, it hinges on a specific feature path, and the likely blast radius is constrained by the iOS app sandbox and the fact that Chrome on iOS is not a normal desktop Chromium exposure story. With no KEV listing, no public exploitation evidence, and a very low EPSS, this is worth fixing but not worth stampeding 10,000 endpoints over.

Why this verdict

• Requires iOS Chrome plus feature-specific user choreography: attacker position starts as *unauthenticated remote*, but the prerequisite implies a social-engineering stage and a victim who actually uses Reading List. That shrinks exposed population well below general Chrome numbers, and modern email/SMS filtering plus basic user skepticism should stop many attempts before the bug is touched.
• Product scope is narrower than the CVSS baseline suggests: this affects Chrome on iOS, not your Windows/Mac/Linux desktop fleet. In real enterprises, the fraction of users running vulnerable Chrome on managed iPhones/iPads is usually a subset of the browser population, so the vendor's generic browser score deserves a downward adjustment.
• Likely blast radius is app-context, not infrastructure foothold: the bug class is input validation in a UI feature, not a proven sandbox escape or server-side pre-auth path. Modern iOS app containment acts as a real amplifier reducer, so even a successful trigger is less strategically dangerous than the same score on desktop Chromium or an exposed edge appliance.
• No exploitation pressure: the user-supplied EPSS 0.00066, lack of KEV listing, and absence of a public PoC or campaign reporting all argue against urgent adversary focus. Threat intel here applies downward pressure because there is no evidence of weaponization momentum.

Why not higher?

It is not higher because too many things have to line up: the victim must be on the right platform, use the right browser, and perform the right in-app interaction. That is a real exploit chain, but it is a narrow chain, and narrow chains do not deserve server-RCE-style treatment absent active exploitation or a demonstrated sandbox/device escape.

Why not lower?

It is not lower because the attacker can still begin from a remote content lure and potentially abuse browser trust in a way that matters for enterprise identity and data. Even app-scoped script/HTML injection or spoofing on a managed mobile device can produce credential capture, session abuse, or sensitive content exposure, so this is more than backlog trivia.

1. Inventory vulnerable iOS Chrome installs — Use MDM or app inventory now to enumerate Chrome on iOS < 149.0.7827.53. There is no noisgate mitigation SLA for MEDIUM; use this immediately as scoping work and complete remediation inside the 365-day window.
2. Force app updates through MDM/App Store policy — If you manage iOS app versions, push or require update to 149.0.7827.53+. There is no mitigation SLA — go straight to the 365-day remediation window, but for high-risk user groups you should close the gap in the next normal mobile-app maintenance cycle, not at the end of the year.
3. Restrict Chrome as default browser for high-risk roles until updated — For executives, admins, or heavily phished populations, temporarily prefer a managed browser policy that reduces exposure to outdated Chrome on iOS if your environment supports it. Use this only as a short-term containment measure while you finish remediation within the 365-day window.
4. Coach users away from untrusted Reading List saves — A lightweight awareness note helps because this chain depends on specific UI interaction. Tell users not to save content from unsolicited links into Reading List until their device shows the updated Chrome version; again, there is no mitigation SLA for MEDIUM, so treat this as opportunistic friction reduction.

Run this on an auditor workstation or CI runner, not on the iPhone itself. Export an MDM/app-inventory CSV with columns like device_id,platform,app_name,app_version, then run python3 check_cve_2026_11272.py devices.csv; no admin rights are needed, just read access to the CSV.

#!/usr/bin/env python3
# Check exposure to CVE-2026-11272 in Chrome on iOS
# Usage: python3 check_cve_2026_11272.py devices.csv
# Expected CSV headers: device_id, platform, app_name, app_version
# Exit codes:
#   0 = all matching rows patched or no Chrome iOS rows found
#   1 = one or more vulnerable rows found
#   2 = unknown / bad input / missing required headers

import csv
import re
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)
REQUIRED_HEADERS = {"device_id", "platform", "app_name", "app_version"}


def parse_version(v):
    if v is None:
        return None
    s = str(v).strip()
    if not s:
        return None
    m = re.findall(r"\d+", s)
    if len(m) < 2:
        return None
    parts = [int(x) for x in m[:4]]
    while len(parts) < 4:
        parts.append(0)
    return tuple(parts)


def is_ios(platform):
    if platform is None:
        return False
    p = str(platform).strip().lower()
    return p in {"ios", "iphoneos", "ipad os", "ipados", "ipad", "iphone"}


def is_chrome(app_name):
    if app_name is None:
        return False
    a = str(app_name).strip().lower()
    return a in {"google chrome", "chrome", "googlechrome"}


def cmp_ver(a, b):
    return (a > b) - (a < b)


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_cve_2026_11272.py devices.csv")
        sys.exit(2)

    path = Path(sys.argv[1])
    if not path.is_file():
        print(f"UNKNOWN - file not found: {path}")
        sys.exit(2)

    vulnerable = 0
    patched = 0
    unknown = 0
    matched = 0

    try:
        with path.open(newline="", encoding="utf-8-sig") as f:
            reader = csv.DictReader(f)
            if reader.fieldnames is None:
                print("UNKNOWN - CSV has no headers")
                sys.exit(2)
            headers = {h.strip() for h in reader.fieldnames if h is not None}
            missing = REQUIRED_HEADERS - headers
            if missing:
                print("UNKNOWN - missing required headers: " + ", ".join(sorted(missing)))
                sys.exit(2)

            for row in reader:
                device_id = str(row.get("device_id", "")).strip() or "<unknown-device>"
                platform = row.get("platform")
                app_name = row.get("app_name")
                app_version = row.get("app_version")

                if not (is_ios(platform) and is_chrome(app_name)):
                    continue

                matched += 1
                ver = parse_version(app_version)
                if ver is None:
                    unknown += 1
                    print(f"UNKNOWN,{device_id},{platform},{app_name},{app_version}")
                    continue

                if cmp_ver(ver, FIXED) < 0:
                    vulnerable += 1
                    print(f"VULNERABLE,{device_id},{platform},{app_name},{app_version}")
                else:
                    patched += 1
                    print(f"PATCHED,{device_id},{platform},{app_name},{app_version}")

    except Exception as e:
        print(f"UNKNOWN - failed to parse CSV: {e}")
        sys.exit(2)

    if matched == 0:
        print("PATCHED - no Chrome on iOS rows found in input")
        sys.exit(0)

    print(f"SUMMARY matched={matched} vulnerable={vulnerable} patched={patched} unknown={unknown} fixed_version=149.0.7827.53")

    if vulnerable > 0:
        sys.exit(1)
    if unknown > 0:
        sys.exit(2)
    sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases
2. openSUSE patchinfo listing Chrome CVEs including CVE-2026-11272
3. Apple Developer: Using alternative browser engines in the European Union
4. Chromium source: iOS Chrome Architecture
5. Chromium issue showing Reading List exists as an iOS-specific code path
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data and stats
8. Google Chrome Help: update Chrome on iPhone and iPad