Using Shortcuts to Bypass Chrome for iOS Call Prompts
Attack Techniques & Methods2026-10-16, 07:46
The research demonstrates a way to bypass the confirmation prompt for launching third-party applications. It uses the built-in Shortcuts app and its URL schemes
shortcuts:// and the legacy workflow://. The URL can include the x-error, x-success or x-cancel parameters, that is, another URL that Shortcuts will open after the shortcut fails, succeeds or is cancelled. This could be, for example, a call via tel: or facetime:. The operating system opens it directly, bypassing Chrome, so the browser never checks the final destination.The vulnerability was assigned the identifier CVE-2026-13795. It allowed a web page to launch an installed application with a single tap, without confirmation from the browser.
First: Shortcuts opened without a warning.
Before launching third-party applications, Chrome usually asks the user for confirmation. It treated Shortcuts as a trusted Apple application and opened it immediately.
Second: Shortcuts can open a URL after a shortcut finishes running.
The
x-success, x-cancel and x-error parameters contain complete URLs. Shortcuts follows them after a successful execution, cancellation, or error. The URL scheme can be anything, including tel:.
Third: Chrome checked only the first URL in the chain.
The browser allows a direct call link only if the user has recently tapped the screen. But a call launched later by Shortcuts never reaches Chrome.Putting it all together:
html
<a href="shortcuts://run-shortcut?name=nonexistent&x-error=tel%3A%2F%2FPHONE_NUMBER">Continue</a>```
1. The victim taps the link in Chrome.
2. Chrome opens Shortcuts without a warning.
3. Shortcuts stores the call URL as the action to perform in case of an error.
4. The requested shortcut does not exist, and execution ends with an error.
5. Shortcuts asks the system to open the call URL.
6. iOS passes the telephone request to the registered handler, typically the Phone app.
Chrome was involved in the second step, but not the fifth. It allowed a webpage to open a URL handled by an installed app with a single tap, bypassing Chrome's confirmation prompt for the final destination.
Fix: Chromium now asks for confirmation before opening any Shortcuts URL. The check is performed on the first transition, so nested URLs do not need to be parsed.
Article: https://blog.doyensec.com/2026/09/24/chrome-ios-policy-bypass.htmlVulnerabilities
Vendors
Products