CVE-2026-13777: Critical Heap Corruption in Google Chrome on iOS – Urgent Patch Required

Technical summary

CVE-2026-13777 is a heap corruption vulnerability in Google Chrome's iOSWeb component affecting iOS deployments prior to version 150.0.7871.47. The root cause is insufficient input validation (CWE-20) of untrusted data before it is processed by memory-sensitive operations. An attacker can construct a malicious HTML document that, when loaded in the vulnerable browser, triggers out-of-bounds memory access or corruption in the heap. The attack requires user interaction (visiting a link or webpage) but no authentication or elevated privileges. The Chromium security team has assigned this a Critical severity rating internally, and the CVSS 3.1 score of 8.8 (HIGH) reflects the combination of remote exploitability, lack of preconditions, and high impact on confidentiality, integrity, and availability.

Business impact

This vulnerability poses a direct risk to iOS users of Google Chrome, potentially allowing attackers to steal sensitive data, modify cached content, or cause application crashes. For organizations with BYOD policies or employees using Chrome on personal iOS devices to access corporate resources, the vulnerability expands the attack surface. Heap corruption can be leveraged for code execution, meaning attackers could potentially gain control of the browser process and access stored credentials, session tokens, or cached corporate data. The need for user interaction (visiting a malicious page) limits but does not eliminate real-world risk, particularly in targeted campaigns using social engineering or malvertising.

Affected systems

Google Chrome on iOS prior to version 150.0.7871.47 is the primary affected product. While the source data lists other operating systems (macOS, Linux, Windows), the vulnerability is explicitly described as affecting iOSWeb in Chrome on iOS. Organizations should verify the status of Chrome on other platforms through official Chromium security advisories, as the description does not indicate equivalent iOSWeb exposure on desktop Chrome builds. Any iOS device running the vulnerable Chrome version is at risk if the user visits a crafted webpage.

Exploitability

The attack requires a network vector and user interaction—specifically, the user must navigate to or load a malicious HTML page. There are no prerequisites around authentication or special system configuration. The barrier to exploitation is moderate: an attacker must craft a specific HTML payload tailored to trigger heap corruption in the iOSWeb rendering engine. Social engineering, phishing, or malvertising could deliver the malicious page to targets. Once the page is loaded, exploitation occurs automatically without further user action. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning in-the-wild exploitation has not been publicly confirmed as of the publication date; however, the critical internal rating and high CVSS score suggest this is an attractive target for threat actors.

Remediation

Users must update Google Chrome on iOS to version 150.0.7871.47 or later. On iOS, Chrome updates are typically delivered through the Apple App Store; users should check for pending updates in their device settings or the App Store app. Organizations managing iOS devices via mobile device management (MDM) should deploy the patch through their MDM console and verify successful rollout. Until patching is complete, users should avoid clicking untrusted links and visiting unfamiliar websites, though this is not a substitute for patching. Consider blocking or warning users about untrustworthy sources of web content via enterprise security policies.

Patch guidance

Verify the availability of Chrome 150.0.7871.47 through the Apple App Store for iOS. If your organization uses enterprise distribution or MDM, confirm that the patch is available in your deployment channel. Prioritize patching for all iOS Chrome instances, particularly on devices that access or store sensitive corporate information. Create an inventory of Chrome-on-iOS installations if not already maintained; mobile asset management tools can assist. Test the patch in a controlled environment if feasible, though Chrome updates are generally low-risk. Monitor update success metrics via MDM reporting and follow up on devices that fail to patch within your defined service-level objective.

Detection guidance

Network-level detection is difficult because the attack vector is a crafted HTML page, which may be hosted on legitimate-looking domains. Endpoint detection should focus on monitoring Chrome crash logs and memory protection violations on iOS, if your MDM or security platform supports such telemetry. Look for unusual Chrome process termination correlated with web browsing activity. Since heap corruption may be a precursor to code execution, monitor for suspicious post-exploitation activities such as unauthorized keychain access, unexpected app permissions changes, or network traffic from the device to known malicious infrastructure. Behavioral indicators on the user's device (slowness, unexpected data usage, new app installations) may suggest successful compromise, though these are non-specific. Threat intelligence feeds may identify infrastructure hosting known malicious HTML payloads; share indicators with your SIEM and web filtering tools.

Why prioritize this

While the KEV catalog has not yet flagged this vulnerability, the combination of a Critical Chromium rating, high CVSS score (8.8), remote and user-interactive attack vector, and wide user base of Chrome on iOS makes this a high-priority patch. Heap corruption vulnerabilities are often precursors to code execution, meaning successful exploitation could lead to full device compromise. The relatively low barrier to weaponization (crafted HTML page via phishing or malvertising) increases real-world risk. Organizations with employees using Chrome on iOS should treat this as urgent, particularly if those devices access email, cloud services, or other corporate systems.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) is justified by: (1) Network attack vector (AV:N) — the vulnerability is remotely reachable via the internet; (2) Low attack complexity (AC:L) — no special conditions are required beyond crafting an HTML page; (3) No authentication or privileges required (PR:N, UI:R) — the attacker does not need to be logged in, though user interaction is needed to visit the page; (4) High impact across confidentiality, integrity, and availability (C:H, I:H, A:H) — heap corruption can lead to information disclosure, data modification, and denial of service. The score reflects the realistic likelihood that an attacker can craft and deliver an exploitable payload to a user, and the severity of the resulting compromise. The internal Chromium Critical rating underscores the severity within the browser ecosystem.

Frequently asked questions