CVE-2026-13905: Chrome iOS Race Condition Memory Disclosure (CVSS 4.2)

Technical summary

A race condition (CWE-362) exists in Chrome's iOS implementation where concurrent memory access during a critical operation allows a local, unauthenticated attacker to read sensitive data from process memory. The race window is narrow and requires precise timing, reflected in the CVSS vector's high attack complexity (AC:H). The vulnerability requires physical access (AV:P) and does not permit modification or denial of service—only confidentiality impact.

Business impact

For organizations managing iOS devices running Chrome, this vulnerability poses a targeted data exfiltration risk in high-security environments. An attacker with momentary physical access could potentially extract cached credentials, tokens, or browsing data. The impact is primarily confidentiality-related and most relevant to enterprises with sensitive intellectual property or those in physically accessible locations where device theft or brief device access is a plausible threat model.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are affected. The vulnerability is specific to iOS and does not affect Chrome on Android, macOS, Windows, or Linux. Any iOS device running an affected version of Chrome is in scope.

Exploitability

Exploitation requires physical possession of or immediate access to an unlocked iOS device, making this a low-probability attack vector for most organizations. The attacker must trigger the race condition with precise timing while Chrome is running, then read the targeted memory region before the window closes. No user interaction is required, and no authentication is necessary, but the attack complexity is inherently high due to the race condition's narrow window. This is not remotely exploitable.

Remediation

Upgrade Google Chrome on iOS to version 150.0.7871.47 or later. Users should also consider enabling iOS security features such as Auto-Lock and Face ID/Touch ID to reduce the window of time a stolen or borrowed device remains accessible.

Patch guidance

Verify that all iOS devices in your environment have updated Chrome to version 150.0.7871.47 or later. On iOS, Chrome updates are typically delivered through the Apple App Store. Users can manually check for updates in the App Store or enable automatic app updates in iOS Settings. Organizations managing iOS devices via MDM should verify that Chrome's latest version is deployed and that automatic updates are enabled where policy permits.

Detection guidance

Detection of active exploitation is difficult because the attack leaves minimal forensic artifacts—it requires only reading process memory during a brief race condition window. Instead, focus on preventive measures: enforce device lock policies, monitor for unusual physical access to devices in secure areas, and ensure Chrome is kept current through patch management. Log suspicious failed update attempts if your MDM logs such events. Consider monitoring for unauthorized device access or theft reports as a leading indicator.

Why prioritize this

Although the CVSS score is moderate (4.2) and the vulnerability is not yet on CISA's KEV list, it deserves timely patching because: (1) the attack vector is physical access, which is less common but high-impact in targeted scenarios, (2) race conditions can be difficult for users to understand or defend against without patching, and (3) iOS users may not immediately adopt the latest Chrome version. Prioritize based on device location and sensitivity: devices in physically secure facilities can be patched on a standard cycle, while devices in open offices or field settings warrant faster patching.

Risk score, explained

The CVSS score of 4.2 (Medium) reflects the specific constraints of this vulnerability: physical access requirement (AV:P) sharply limits exploitability compared to network attacks, and the race condition's inherent timing sensitivity (AC:H) further narrows the attack window. Confidentiality impact is high (C:H) because memory can contain sensitive data, but there is no integrity or availability impact. The overall score appropriately captures a real but situational risk.

Frequently asked questions