CVE-2026-13915: Chrome iOS Use-After-Free Vulnerability (CVSS 8.8)

Technical summary

This vulnerability is classified as a use-after-free (CWE-416) in the Chromium rendering engine on iOS. Use-after-free flaws occur when an application references memory that has already been freed, allowing attackers to manipulate heap structures and achieve code execution or data corruption. In this case, a crafted HTML page can trigger the dangling pointer dereference when a user interacts with the page via specific UI gestures. The flaw resides in Chrome for iOS specifically, meaning it affects iPhone and iPad users running vulnerable Chrome versions. The attack surface is broad because no authentication or elevated privileges are needed—only user interaction with a webpage hosted on the attacker's infrastructure.

Business impact

Successful exploitation could lead to complete compromise of an affected iOS device, including unauthorized access to sensitive data, device manipulation, or installation of malware. For enterprises managing BYOD (bring-your-own-device) programs or relying on iOS devices for corporate work, this represents a material risk to confidentiality and integrity of business data. Users who browse untrusted content or are targeted with spear-phishing links hosting the exploit page face direct personal risk. The requirement for user interaction (clicking, tapping, or scrolling on a malicious page) lowers barrier to attack compared to zero-click vulnerabilities, but social engineering can reliably trigger the necessary gestures.

Affected systems

Google Chrome on iOS (iPhone OS) versions prior to 150.0.7871.47 are vulnerable. This includes all Chrome releases distributed through Apple's App Store for iPhones and iPads before the patched version. The vulnerability does not affect Chrome on Android, Windows, macOS, or other platforms—only the iOS variant is impacted due to platform-specific rendering code paths.

Exploitability

Exploitability is moderately straightforward. An attacker must host a specially crafted HTML page and convince a user to visit it via link, advertisement, or social engineering. The user must then engage in specific UI interactions (likely scrolling, pinch-zoom, or tapping elements). No browser plugins, extensions, or user configuration changes are required. The lack of user authentication requirements and the network accessibility of the attack vector elevate practical exploitability. However, the requirement for user gesture means silent, background exploitation is unlikely. Threat actors would need to combine this flaw with social engineering or advertising network compromises to achieve broad impact.

Remediation

Update Chrome for iOS to version 150.0.7871.47 or later. Users should enable automatic app updates in the Apple App Store settings to receive patches promptly. Organizations managing iOS devices should enforce app update policies via Mobile Device Management (MDM) solutions and consider restricting Chrome usage in favor of managed browsers with faster patch deployment if internal risk tolerance is low.

Patch guidance

Google released version 150.0.7871.47 of Chrome for iOS as the patched build. Verify this version number against Google's official Chrome release notes and Apple's App Store listing. Most users on automatic updates will receive the patch within days of release. Manual installation may be required for users with automatic updates disabled. Organizations using Apple Business Manager or similar enterprise distribution channels should trigger deployment of the patched version immediately. There are no known interim mitigations; patching is the primary control.

Detection guidance

Monitor Chrome crash reports and device logs for heap corruption exceptions or unexpected Chrome terminations. On iOS, crashes may be visible through Apple's Crash Reporter and MDM analytics if configured. Network-based detection is limited since the attack uses standard HTTPS traffic to a legitimate-looking webpage; behavioral detection of malicious HTML crafting on web servers is possible but requires advanced content inspection. User education remains critical—encourage reporting of unexpected Chrome crashes or unresponsive browser behavior. Endpoint Detection and Response (EDR) tools on iOS are limited compared to desktop platforms, so patch velocity is the primary defense.

Why prioritize this

Assign this vulnerability high priority despite Google's internal 'Medium' severity rating. The CVSS 8.8 score reflects the true risk: network accessibility, no privilege requirement, and complete system compromise potential. The use-after-free class is a common precursor to remote code execution. While the requirement for user interaction reduces likelihood compared to zero-click flaws, the ease of social engineering and the ubiquity of iPhones in both consumer and enterprise environments make this a material threat. Organizations with iOS-dependent workflows should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: Attack Vector (Network) = remote exploitation over the internet; Attack Complexity (Low) = no special conditions needed; Privileges Required (None) = standard user can trigger the flaw; User Interaction (Required) = the user must perform specific gestures, which is a limiting factor but achievable via social engineering; Scope (Unchanged) = only Chrome process is affected; Confidentiality/Integrity/Availability Impact (High for all three) = successful exploitation grants read, write, and execute capabilities within the process context. The internal 'Medium' severity rating from Google likely reflects lower real-world exploitation rates or the presence of mitigating platform features on iOS; however, the CVSS model correctly captures the maximum potential impact if the vulnerability is exploited.

Frequently asked questions