CVE-2026-13807: Chrome iOS Use-After-Free Vulnerability – Patch Now

Technical summary

CVE-2026-13807 is a use-after-free memory safety vulnerability (CWE-416) in the Import component of Chromium-based Chrome on iOS. The flaw occurs when a freed memory region is accessed after deallocation, leading to memory corruption. An attacker supplies a specially crafted file that, when imported by a user, triggers unsafe memory access in the import handler. This permits arbitrary code execution in the context of the Chrome process. The vulnerability requires user interaction but not authentication, and isolation is limited to the renderer process sandbox on iOS.

Business impact

For organizations with mobile workforces relying on iOS devices for secure browsing and data handling, this vulnerability poses a material risk. A compromised Chrome process could lead to credential theft, sensitive data exfiltration, session hijacking, or installation of persistent malware on the device. If Chrome is used to access corporate resources, internal applications, or cloud infrastructure, the impact extends beyond the browser sandbox. Rapid patching is critical to prevent supply-chain attacks where malicious files are distributed through email, messaging, or file-sharing services.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are vulnerable. The vulnerability is specific to the Chrome browser on Apple iPhone OS; other Chromium-based browsers or desktop Chrome versions may have different patch timelines. iOS versions themselves are not affected—the vulnerability lies in the Chrome application layer. Any organization or user running an unpatched Chrome instance on iOS is at risk if they download or import files from untrusted sources.

Exploitability

Exploitability is moderate to high in real-world scenarios. The attack requires user interaction—specifically, the user must be convinced to engage with a malicious file within the import UI. However, social engineering can be effective, especially if the file appears legitimate (e.g., a spreadsheet, document, or archive). No network-level exploitation or advanced technical user skills are required on the attacker's side. The barrier to exploitation is primarily social rather than technical, making it likely to be weaponized if the vulnerability becomes widely known and a reliable payload is developed.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users can check their current version in Chrome Settings > About Chrome, which will also prompt an automatic update if one is available. Organizations managing iOS devices via MDM should push this update through their mobile device management solution with priority classification. For users unable to immediately update, the mitigation is to avoid importing files from untrusted sources and disable file downloads in Chrome if business processes permit.

Patch guidance

Apple's App Store will deliver Chrome 150.0.7871.47 and newer versions automatically or via the Updates tab. Verify the version number post-update in Chrome Settings > About Chrome. For enterprises using managed iOS devices, create a forced-update policy targeting Chrome to version 150.0.7871.47 minimum. Test the update in a pilot group before full rollout to ensure compatibility with line-of-business applications. Consider monitoring for attempted exploitation through file import logs if your organization has security logging infrastructure for mobile apps.

Detection guidance

Detection at the endpoint is challenging without platform-level process monitoring (available via MDM solutions with advanced telemetry). Monitor for unusual Chrome process terminations or crashes, which may indicate exploitation attempts. At the network level, inspect email and file-sharing gateways for suspicious file types (particularly archives, documents, or files with double extensions) being sent to iOS users. Log and alert on unusual file import activity if your organization has application-level logging. Post-exploitation forensics on iOS is limited; focus on rapid patching and user education as primary defenses.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.5), high Chromium severity rating, and the prevalence of Chrome on iOS devices. While KEV status is not yet assigned, the vulnerability is demonstrable, requires only user-level interaction, and leads to code execution. Organizations should treat this as a P1 or P2 priority depending on mobile device population and reliance on Chrome for business functions. Early patching prevents opportunistic exploitation before advanced toolkits are developed.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high impact (confidentiality, integrity, and availability compromised via arbitrary code execution) balanced against moderate attack complexity (AC:H) due to the requirement for specific user gestures. Network accessibility (AV:N) and lack of privilege escalation requirement (PR:N) elevate the score. The score appropriately reflects the real-world threat: while not remotely exploitable without user action, the combination of widespread Chrome adoption, iOS market penetration, and the ease of social engineering file imports justifies the HIGH severity classification.

Frequently asked questions