CVE-2026-10896: Use-After-Free in Chrome for iOS Allows Arbitrary Code Execution

Technical summary

CVE-2026-10896 is a use-after-free bug (CWE-416) in the Chrome for iOS rendering engine. The vulnerability arises when Chrome attempts to access a memory object that has already been freed, allowing an attacker-controlled HTML page to trigger code execution in the context of the browser process. The attack vector is network-based with low complexity; no privileges or special configuration are required. User interaction is limited to visiting a webpage, making this a practical remote code execution risk for iOS users running vulnerable Chrome versions.

Business impact

Organizations whose employees use Chrome on iOS devices face direct risk of device compromise and data exfiltration. Attackers exploiting this vulnerability can gain arbitrary code execution, potentially leading to theft of authentication credentials, business communications, browsing data, and access to enterprise resources synced or cached on personal devices. Even in BYOD environments, the risk extends to corporate data accessed through those browsers.

Affected systems

Google Chrome for iOS versions prior to 149.0.7827.53 are vulnerable. The vulnerability also affects Apple iPhone OS, as Chrome for iOS runs on that platform. Organizations should audit deployment of Chrome on iOS and establish baseline versions. Desktop Chrome versions are not affected by this specific iOS-targeted vulnerability.

Exploitability

Exploitability is straightforward: an attacker needs only to host a crafted HTML page and trick or direct a user to visit it. No authentication, elevated privileges, or user-side technical steps are required. The barrier to exploitation is low, making this a practical threat in scenarios involving phishing, malicious advertisements, or compromised websites. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of the latest update, though active exploitation cannot be ruled out given the critical nature and simplicity of the attack surface.

Remediation

Update Chrome for iOS to version 149.0.7827.53 or later. Google typically releases Chrome updates automatically, but users should verify their installed version via the App Store or within Chrome's settings (Menu > About Google Chrome). IT departments should communicate the update urgently to users and consider deploying Mobile Device Management (MDM) policies to enforce minimum Chrome versions or restrict the browser on corporate devices pending update completion.

Patch guidance

Visit the Chrome App Store listing and confirm the installed version matches 149.0.7827.53 or exceeds it. Automatic updates are enabled by default on most iOS devices; however, users should check Settings > [Your Name] > iTunes & App Store and confirm automatic app updates are enabled. For enterprise environments, use MDM solutions (Intune, Jamf, MobileIron) to enforce version compliance and restrict usage of older builds. Verification should be completed within 48 hours of patch availability given the critical severity.

Detection guidance

Monitor device inventory for Chrome installations and version numbers via MDM telemetry. Log unusual network activity or crashes on iOS devices correlating with user browsing. Endpoint Detection and Response (EDR) solutions with iOS support can flag suspicious code execution patterns. Network-based detection is limited without on-device logging; prioritize user education to report suspicious browser crashes or unexpected device behavior. Check App Store management consoles for deployment status of the patched version.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of remote exploitability, arbitrary code execution impact, and the ubiquity of iOS in the workforce. The attack requires no user sophistication beyond visiting a webpage, and the consequences—device compromise, credential theft, lateral movement—are severe. Despite not yet appearing in the KEV catalog, the low barrier to weaponization and high potential for abuse in targeted phishing campaigns justify urgent remediation.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity, no privilege requirement, and high impact across confidentiality, integrity, and availability. While Chromium's internal severity is Critical, the CVSS HIGH rating aligns with practical risk: exploitation is trivial, but impact is contingent on user browsing behavior and attacker targeting. Organizations should treat this as a Critical priority in their own risk models given the business context and attack surface.

Frequently asked questions