Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149

CVE-2026-11274 is a navigation-restriction bypass in DOM Distiller — Chrome's reader-mode/distillation plumbing — affecting Google Chrome on iOS before 149.0.7827.53. A malicious page can apparently abuse that code path to steer navigation in ways Chrome intended to block, but the published description stops at bypass navigation restrictions via a crafted HTML page; there is no evidence here of code execution, sandbox escape, credential theft by itself, or cross-app compromise.

The vendor's MEDIUM 4.3 is already modest, but in enterprise reality this lands even lower. The friction stack is heavy: user interaction is required, the victim must be on Chrome for iOS specifically, the exploit has to hit the DOM Distiller/reader-mode path, and the stated impact is only integrity-low. That makes this a phishing/spoofing amplifier at worst, not a broad fleet-burner.

Why this verdict

• Baseline down from 4.3 because UI:R matters: the attacker needs the victim to open crafted content, which removes the mass-drive-by value you worry about in fleet triage
• Further down because attacker reach is narrow: this is Chrome on iOS only, which already implies a subset of your mobile population and excludes desktops, Android, and Safari-heavy iPhone fleets
• Further down because the vulnerable path is feature-specific: DOM Distiller / Reader Mode is not the dominant browsing path, so the reachable population is smaller than the CVSS line item suggests
• Further down because impact is weak: the stated outcome is a navigation restriction bypass with I:L / C:N / A:N, not code execution, account takeover, or container escape
• No upward pressure from threat intel: no KEV listing, no public exploitation evidence, and an EPSS of 0.0002 all argue against emergency handling

Why not higher?

There is no evidence of RCE, sandbox escape, credential disclosure by default, or cross-device wormability. The exploit chain also assumes both user interaction and a niche feature path, which is exactly the kind of compounding friction that should keep a browser bug out of HIGH unless exploitation evidence shows otherwise.

Why not lower?

It is still a remote, user-triggerable browser flaw in a product some enterprises do manage on corporate iPhones. Even low-grade navigation control can improve phishing reliability, so this should not be hand-waved away as purely informational.

1. Enforce minimum app version — Use MDM/App Store compliance to require Chrome iOS 149.0.7827.53+ on managed devices. For a LOW verdict there is no mitigation SLA and no formal remediation SLA beyond backlog hygiene, so fold this into the next normal mobile app enforcement cycle rather than creating emergency change debt.
2. Keep phishing controls in front of mobile users — Safe-link rewriting, URL reputation, and mobile threat defense blunt the real abuse case here: luring users into malicious destinations after a navigation bypass. Because this is LOW, treat these as standing controls, not emergency-only measures.
3. Monitor browser inventory by bundle ID and version — Inventory is the only scalable way to answer whether you actually have exposure, because network scanners cannot see into iPhone app versions. Add a recurring MDM check for the Chrome iOS bundle and version and clean up drift as backlog hygiene.
4. Prefer phishing-resistant auth on mobile — If the bug is used as a redirect/spoofing helper, the follow-on kill chain is usually credential capture. Passkeys, FIDO2, and conditional access reduce the value of a prettier phishing page even when the browser is imperfect.

Run this on an auditor workstation or MDM reporting host, not on the iPhone itself. Invoke it against a CSV export such as python3 check_chrome_ios_cve_2026_11274.py mdm_apps.csv; it needs no admin rights, only read access to the export. Expected columns can be any of: device_id, bundle_id, app_name, version.

#!/usr/bin/env python3
# Check exposure to CVE-2026-11274 in Chrome on iOS using an MDM/exported CSV
# Usage: python3 check_chrome_ios_cve_2026_11274.py mdm_apps.csv
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import csv
import re
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)
IOS_CHROME_BUNDLES = {
    'com.google.chrome.ios',
    'com.google.chrome',
}
IOS_CHROME_NAMES = {
    'chrome',
    'google chrome',
    'chrome for ios',
}


def norm(s):
    return (s or '').strip().lower()


def parse_version(s):
    if not s:
        return None
    nums = re.findall(r'\d+', s)
    if len(nums) < 2:
        return None
    parts = tuple(int(x) for x in nums[:4])
    if len(parts) < 4:
        parts = parts + (0,) * (4 - len(parts))
    return parts


def is_ios_chrome(row):
    bundle = norm(row.get('bundle_id') or row.get('bundle') or row.get('package_id') or row.get('identifier'))
    name = norm(row.get('app_name') or row.get('name') or row.get('application') or row.get('product'))
    platform = norm(row.get('platform') or row.get('os') or row.get('operating_system'))

    bundle_hit = bundle in IOS_CHROME_BUNDLES
    name_hit = name in IOS_CHROME_NAMES
    ios_hint = ('ios' in platform) or ('iphone' in platform) or ('ipad' in platform) or (bundle == 'com.google.chrome.ios')

    if bundle_hit:
        return True
    if name_hit and ios_hint:
        return True
    return False


def device_label(row, index):
    for key in ('device_id', 'device', 'hostname', 'serial', 'udid', 'user'):
        if row.get(key):
            return str(row.get(key))
    return f'row_{index}'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_chrome_ios_cve_2026_11274.py <mdm_csv_export>')
        sys.exit(2)

    path = Path(sys.argv[1])
    if not path.exists() or not path.is_file():
        print(f'UNKNOWN - file not found: {path}')
        sys.exit(2)

    checked = 0
    vulnerable = []
    unknown = []

    try:
        with path.open('r', encoding='utf-8-sig', newline='') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN - CSV has no header row')
                sys.exit(2)

            for idx, row in enumerate(reader, start=2):
                if not is_ios_chrome(row):
                    continue

                checked += 1
                ver_str = row.get('version') or row.get('app_version') or row.get('short_version') or row.get('installed_version')
                ver = parse_version(ver_str)
                label = device_label(row, idx)

                if ver is None:
                    unknown.append((label, ver_str or ''))
                    continue

                if ver < FIXED:
                    vulnerable.append((label, ver_str))

    except Exception as e:
        print(f'UNKNOWN - failed to parse CSV: {e}')
        sys.exit(2)

    if checked == 0:
        print('UNKNOWN - no Chrome on iOS records found in CSV')
        sys.exit(2)

    if vulnerable:
        sample = ', '.join(f'{d}={v}' for d, v in vulnerable[:10])
        extra = '' if len(vulnerable) <= 10 else f' ... and {len(vulnerable) - 10} more'
        print(f'VULNERABLE - {len(vulnerable)} Chrome iOS record(s) below 149.0.7827.53; sample: {sample}{extra}')
        sys.exit(1)

    if unknown:
        sample = ', '.join(f'{d}={v}' for d, v in unknown[:10])
        extra = '' if len(unknown) <= 10 else f' ... and {len(unknown) - 10} more'
        print(f'UNKNOWN - {checked} Chrome iOS record(s) found, but {len(unknown)} version value(s) could not be parsed; sample: {sample}{extra}')
        sys.exit(2)

    print(f'PATCHED - {checked} Chrome iOS record(s) are at or above 149.0.7827.53')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. SUSE CVE page for CVE-2026-11274
2. openSUSE patchinfo listing Chromium 149 fixes including CVE-2026-11274
3. Chrome Stable for iOS Update 149.0.7827.45
4. Chrome Releases homepage showing 149.0.7827.53/.54 early stable rollout
5. Chromium DOM Distiller README
6. Chromium layered components design note for iOS shared-code constraints
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation