CVE-2026-10958: Use-After-Free in Chrome for iOS Allows Remote Code Execution

Technical summary

CVE-2026-10958 is a use-after-free vulnerability (CWE-416) in the Chrome rendering engine on iOS. The vulnerability occurs when Chrome fails to properly manage memory for certain UI objects, allowing an attacker to reference freed memory and execute arbitrary code with browser context privileges. The attack vector is network-based, requires no special privileges, and depends on user interaction—specifically, the victim must perform defined UI gestures on a page served by an attacker. The vulnerability affects the interaction between Safari WebKit integration and Chrome's custom UI handling on iOS, making it distinct from desktop Chrome variants.

Business impact

Successful exploitation could lead to credential theft, interception of sensitive communications, malware installation, or unauthorized access to user accounts. For organizations with BYOD policies or employees who use personal iPhones for work email and productivity, this vulnerability poses a direct risk to corporate data. The requirement for user interaction lowers the barrier to weaponization—a phishing campaign combining a crafted webpage link with social engineering is a realistic attack scenario. Threat actors have strong incentive to exploit this before widespread patching.

Affected systems

Google Chrome on iOS versions prior to 149.0.7827.53 are affected. This vulnerability is specific to iOS and does not affect Chrome on Android, macOS, Windows, or Linux. Any iPhone or iPad running an unpatched version of Chrome is at risk. The vulnerability does not affect Safari or other third-party browsers, only Chrome for iOS specifically.

Exploitability

Exploitability is moderate to high in practical scenarios. While the vulnerability requires user interaction (UI gestures), the barrier to triggering those gestures is low—a convincing phishing email or social media link can deliver the malicious HTML page. Once a user taps or swipes as expected during normal browsing, the exploit executes without additional warnings or confirmations. No authentication or privileged access is needed. The attack is triggered remotely via a crafted HTML page, making it suitable for mass-targeting campaigns. However, the specificity of required UI gestures and the need for user engagement prevent this from being effortlessly exploitable.

Remediation

Update Google Chrome on iOS to version 149.0.7827.53 or later immediately. Users can check their current version in Settings > Chrome > About Chrome, which will auto-update if a new version is available. Organizations should communicate this requirement to employees using iPhones, particularly those with work-related browsing. Consider implementing Mobile Device Management (MDM) policies to enforce automatic updates or restrict Chrome usage on unpatched devices. Until patching is complete, users should avoid clicking unfamiliar links in email or messaging apps, especially those requesting specific interactions.

Patch guidance

Google released security updates on 2026-06-04 to address this vulnerability. Verify that devices are running Chrome version 149.0.7827.53 or later by navigating to the About Chrome section; the app will automatically check for and apply updates when connected to Wi-Fi. Organizations managing fleets of iOS devices via MDM can deploy updates through their management console. If auto-update is disabled, users must manually update via the App Store. There is no workaround for unpatched versions other than avoiding untrusted webpages and disabling JavaScript (not practical for most users).

Detection guidance

Monitor Chrome crash logs and security alerts for evidence of use-after-free exploitation, which often manifests as unexpected process termination or memory corruption errors. If MDM is deployed, check for devices still running Chrome versions below 149.0.7827.53. Examine email gateway logs and web proxies for indicators of phishing campaigns delivering malicious HTML pages designed to trigger the vulnerability—look for suspicious link shorteners or obfuscated URLs targeting iOS users. Correlate crash reports with user reports of unexpected Chrome behavior. For incident response, preserve device logs if an employee reports a suspicious browsing event or unusual device behavior after visiting an unexpected link.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), network attack vector, and low complexity. The requirement for user interaction is the primary limiting factor, but this does not significantly reduce risk given the effectiveness of phishing and social engineering. The vulnerability is not yet in the CISA KEV catalog, but its severity, browser ubiquity, and iOS user base make it a target for early exploitation. Organizations should prioritize patching devices with Chrome before attackers develop reliable exploit tooling or integrate the vulnerability into exploit kits.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability requiring no privileges and low attack complexity, but necessitating user interaction. The impact is severe: confidentiality, integrity, and availability are all compromised once arbitrary code execution is achieved within the browser process. The iOS environment provides some sandboxing, limiting device-wide compromise, but the browser sandbox itself is fully defeated. The score appropriately weighs the practical requirement for social engineering against the severe consequences of successful exploitation.

Frequently asked questions