CVE-2026-10951: iOS Chrome Autofill Use-After-Free (CVSS 8.8)

Technical summary

CVE-2026-10951 is a use-after-free vulnerability (CWE-416) in the Autofill subsystem of Google Chrome on iOS versions prior to 149.0.7827.53. The flaw allows an attacker to trigger heap corruption through a specially crafted HTML page combined with specific UI gestures. The vulnerability resides in memory management within the Autofill component, where a freed object may still be referenced after deallocation, leading to undefined behavior and potential code execution. The Chromium security team rated this as High severity.

Business impact

iOS users relying on Chrome face the risk of credential theft if they interact with malicious pages while autofill prompts are active. In enterprise environments where Chrome is a supported browser on BYOD or corporate iOS devices, this vulnerability could enable attackers to exfiltrate passwords, payment information, or session cookies stored in the browser. The requirement for user interaction reduces the attack surface but does not eliminate it—social engineering, drive-by downloads, or phishing remain effective delivery vectors. Organizations without patch deployment mechanisms for managed iOS devices may face prolonged exposure.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 149.0.7827.53 are affected. Desktop and Android versions of Chrome are not impacted by this specific flaw. iOS users across all supported device models running vulnerable Chrome versions are at risk.

Exploitability

The vulnerability requires a user to visit a crafted webpage and perform specific UI interactions—likely related to triggering or interacting with autofill suggestions. This user-interaction requirement prevents worm-like propagation or mass infection but remains a practical attack vector through phishing, malicious advertisements, or compromised legitimate websites. No public exploit code is currently documented, and the flaw has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome on iOS to version 149.0.7827.53 or later. Users should enable automatic updates in the App Store settings to ensure timely patching. Organizations managing iOS fleets should enforce minimum Chrome version policies through their mobile device management (MDM) platform and verify compliance within 30 days of the patch release.

Patch guidance

Navigate to the Apple App Store, search for Google Chrome, and install the latest available version. Confirm the installed version matches 149.0.7827.53 or higher by opening Chrome, tapping the menu icon (three horizontal lines), selecting 'Settings,' then 'About Google Chrome'—the version number displays at the top. For enterprise iOS management, push the updated Chrome package through your MDM solution and set a compliance deadline. Verify patching on a sample of managed devices before closing the remediation ticket.

Detection guidance

Monitor for Chrome version numbers below 149.0.7827.53 on iOS devices via MDM telemetry or inventory management tools. Check for unusual autofill-related crashes or browser terminations in crash analytics. Implement network segmentation to reduce the blast radius if a device becomes compromised. Consider blocking access to high-risk external websites from iOS Chrome clients, or require VPN-protected browsing for sensitive authentication scenarios.

Why prioritize this

This vulnerability combines a high CVSS score (8.8), potential for memory corruption leading to code execution, and a popular attack surface (iOS Chrome on millions of devices). Although exploitation requires user interaction, the combination of autofill prominence in typical user workflows and the pervasive nature of phishing makes this a material risk. The lack of KEV listing suggests limited real-world exploitation to date, but organizations should not delay patching, as it may change rapidly.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the vulnerability's network-accessible attack vector (AV:N), low attack complexity (AC:L), lack of authentication requirements (PR:N), user-interaction dependency (UI:R), and impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The user-interaction requirement prevents a perfect 9.0+ score, but the scope remains unchanged (S:U), meaning exploitation is limited to the affected Chrome process. The severity is justified given that heap corruption can escalate to arbitrary code execution.

Frequently asked questions