CVE-2026-13918: Chrome iOS Use-After-Free Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-13918 is a use-after-free (CWE-416) memory safety vulnerability in the Chrome rendering engine on iOS. When Chrome processes a specially crafted HTML page, it may free memory prematurely while still holding references to that memory. Subsequent access to the freed memory can corrupt the heap, potentially allowing arbitrary code execution within the Chrome sandbox context. The Chromium project classified this as Medium severity, though the CVSS 3.1 score of 8.8 reflects the high practical impact due to low attack complexity and user interaction requirements.

Business impact

iOS users running vulnerable Chrome versions face credential theft, data exfiltration, and device compromise. For enterprises with BYOD policies or iOS-heavy workforces, this vulnerability increases the attack surface for phishing campaigns that host malicious pages. The low barrier to exploitation—simply visiting a link—makes it suitable for mass exploitation attempts. Organizations should prioritize patching to prevent compromised employee devices from becoming pivot points for lateral network movement.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are vulnerable. This includes Chrome on Apple iPhone OS and iPad OS. Desktop Chrome (Windows, macOS, Linux) is not affected by this specific flaw. Other Chromium-based browsers on iOS may also be affected if they use the same rendering engine code path, though Google Chrome is the primary concern.

Exploitability

Exploitability is straightforward. An attacker distributes a link to a malicious HTML page via email, social engineering, or watering hole attacks. When a victim using vulnerable Chrome on iOS visits the page, the use-after-free is triggered automatically—no special browser settings, extensions, or user interaction beyond clicking the link is required. The attack requires network access but no authentication. The lack of complexity and low user friction make this attractive for targeted campaigns and broad exploit attempts alike.

Remediation

Update Chrome on iOS to version 150.0.7871.47 or later. Apple's App Store deployment mechanism typically rolls out updates to Chrome within 24–48 hours of release. Users should enable automatic app updates in iOS settings to avoid manual update steps. Organizations should confirm update deployment through Mobile Device Management (MDM) solutions if managing corporate devices.

Patch guidance

Verify and confirm that all iOS devices running Chrome have been updated to version 150.0.7871.47 or later. Check the Chrome version in Settings > About Google Chrome on affected devices. For MDM-managed environments, push the update through your deployment platform and verify compliance within 7 days of release. If users have disabled automatic updates, send a security notice encouraging immediate manual update. Monitor app store release notes and Google Chrome release channels for confirmation of the patch.

Detection guidance

On-device detection is limited because this is a memory corruption flaw that may not leave persistent logs. Network-level detection should focus on blocking known malicious HTML pages if indicators of compromise are published. Monitor for unusual Chrome crashes or restarts on iOS devices, which may indicate exploitation attempts. If suspicious activity correlates with a user visiting an untrusted website, assume potential compromise and recommend full device review. Endpoint detection platforms with iOS support should flag attempts to access known malicious URLs. Log authentication events for anomalies following device compromise timeframes.

Why prioritize this

Despite Chromium's Medium severity rating, this vulnerability scores 8.8 (HIGH) under CVSS 3.1 due to network-only attack surface, low complexity, and high confidentiality/integrity/availability impact. iOS devices are common in business environments, and the ease of exploitation through standard web browsing makes this a practical threat. Patching has minimal friction because app updates are automatic on modern iOS. The lack of active public exploitation (KEV status: not added) provides a window to patch before widespread abuse, making this a high-priority but not critical-emergency issue.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-only attack vector—no physical access required; (2) Low attack complexity—a standard HTML page triggers the flaw; (3) No privileges required; (4) User interaction required—a user must visit the page, but social engineering is trivial; (5) Unrestricted scope—sandbox escape may be possible; (6) High impact across confidentiality, integrity, and availability. The difference from Chromium's Medium rating likely reflects their stricter process for sandbox-contained flaws, whereas a CVSS evaluation considers full compromise potential.

Frequently asked questions