Loading story…
Doyensec disclosed CVE-2026-13795, an app-launch permission bypass in Chrome for iOS that allowed malicious webpages to abuse Apple Shortcuts deep links. Chrome permitted shortcuts:// and legacy workflow:// URLs to open without the confirmation prompt required for other third-party app schemes.
An attacker could embed a Shortcuts x-callback-url that directed Shortcuts to open sensitive destinations such as tel: or facetime:, bypassing Chrome's user-interaction requirement for the final action. Chromium remediated the issue by requiring an alert before Chrome opens any Shortcuts or Workflow URL, blocking the callback chain unless the user explicitly approves it.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Doyensec documented CVE-2026-13795, an app-launch permission bypass in Chrome for iOS. A malicious webpage could use Apple Shortcuts deep links and callback parameters to reach sensitive schemes such as tel: or facetime: without Chrome applying its final URL user-interaction policy.
Chromium fixed CVE-2026-13795 by requiring an alert before opening any shortcuts:// or legacy workflow:// URL. The initial consent requirement prevents callback chains, including x-success, x-cancel, x-error, and nested Shortcuts URLs, from launching without approval.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chromium fixed **CVE-2026-95355**, a privilege-escalation flaw in iOS Chromium's `CRWWKNavigationHandler`. An attacker that had already achieved renderer code execution could forge navigation to the bundled `error_page_loaded.html` file, making the browser treat attacker-controlled content as a trusted local error page. The trusted error-page state could then allow navigation to a privileged `chrome://` WebUI URL and expose native WebUI bindings to the compromised renderer, enabling a sandbox escape. Chromium addressed the issue on August 21, 2026, in commit `bb617c8b09d43ed4d617d0c2b6769899324c9ee8` by validating error-page navigations against browser-side state and restricting navigations from committed error pages; the fix was targeted for M154 release notes.
Sep 23, 2026
Chromium fixed **CVE-2026-95344**, a Chrome DevTools vulnerability that could let a malicious extension execute JavaScript inside another extension's content-script isolated world. The attack combined a time-of-check/time-of-use flaw in DevTools keyboard-shortcut forwarding with insufficient authorization for evaluation in a debugger-selected call frame. An attacker could pause execution, select a victim extension's frame, and invoke victim-scoped APIs, including `chrome.storage.local`; the issue was demonstrated against MetaMask. Chromium's DevTools frontend changes validate forwarded shortcuts and block ExtensionServer evaluation while paused, with release notes planned for Chrome M154.
Sep 23, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026