CVE-2026-14067: Chrome iOS Use-After-Free RCE Vulnerability – Patch Now

Technical summary

CVE-2026-14067 is a use-after-free vulnerability (CWE-416) in Chrome for iOS. The flaw occurs when the browser's memory management logic fails to properly handle object lifecycle, allowing freed memory to be accessed and written. An attacker can craft a malicious HTML page that triggers this memory corruption, potentially overwriting control flow data or other sensitive structures to achieve arbitrary code execution within Chrome's process. The vulnerability is network-accessible and requires only user interaction (clicking a link or visiting a page), with no special privileges needed. The attack surface is substantial because the vulnerability can be triggered through standard web browsing.

Business impact

Any organization with employees using iPhone devices faces risk exposure. Successful exploitation could lead to credential theft, sensitive data exfiltration (email, documents, session tokens), malware installation, or lateral movement into corporate networks via compromised devices. The attack requires no social engineering beyond a plausible malicious link, making it viable for both targeted and mass exploitation campaigns. Given iOS's role in enterprise environments, this represents a meaningful endpoint security concern that may affect mobile device management (MDM) policies and incident response readiness.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are affected. The vulnerability is specific to Chrome's iOS implementation and does not affect Chrome on Android, Windows, macOS, or Linux. However, the underlying memory management code may be shared or similarly vulnerable across platforms—organizations should verify their patch status across all Chrome deployments. Apple iPhone OS versions that ship with vulnerable Chrome versions are also listed as affected in the CVE record, though the flaw itself resides in Chrome, not iOS.

Exploitability

Exploitability is high. The attack is network-based (AV:N), requires no authentication (PR:N), and needs only user interaction to click a link or visit a page (UI:R). Exploit complexity is low (AC:L), meaning there are no special environmental conditions required. No working public exploits are documented in the Known Exploited Vulnerabilities (KEV) catalog as of the latest update, but the straightforward attack vector and high CVSS score suggest that functional exploits are likely to emerge quickly. Attackers can host malicious pages on compromised or attacker-controlled domains and distribute links via phishing, ads, or social engineering.

Remediation

Update Chrome for iOS to version 150.0.7871.47 or later immediately. Users should check their Chrome version in Settings > About Chrome and enable automatic updates if not already active. Organizations managing iOS devices should deploy this patch through their Mobile Device Management (MDM) solution or notify users to update manually. For sensitive environments, consider supplementary controls: block known malicious URLs via network filtering, educate users about suspicious links, and monitor for signs of compromise (unusual network traffic, credential misuse, unexpected app behavior).

Patch guidance

Verify that your deployed Chrome version on iOS meets or exceeds 150.0.7871.47. On iOS devices, navigate to Settings > About Chrome to confirm the current version. Enable automatic app updates in the App Store settings to ensure future patches are applied without manual intervention. For enterprise deployments, confirm that your MDM policies push this update and that remediation is verified across your iOS fleet. Monitor patch compliance metrics and flag non-compliant devices for remediation. Historical context: Chromium and Chrome release security patches continuously; this patch was released in late June 2026 to address this and other vulnerabilities.

Detection guidance

Monitor for suspicious Chrome crashes or sudden terminations on iOS devices, which may indicate failed exploit attempts. Examine network logs for connections to known malicious domains that might host exploit pages. On the endpoint level, examine MDM logs for patch status. DNS query logs and proxy traffic can reveal if users accessed potentially compromised websites. Behavioral indicators include unexpected elevation of Chrome resource usage, unusual outbound connections from Chrome, or rapid credential usage changes following a suspicious browsing session. EDR tools on connected systems may detect lateral movement attempts originating from a compromised iPhone.

Why prioritize this

This vulnerability merits immediate patching despite the KEV catalog not yet including it. The combination of high CVSS (8.8), network-based attack vector, low complexity, and lack of authentication barriers means the exploit landscape will likely mature rapidly. iOS is increasingly used for business tasks (email, VPN, corporate applications), making successful exploitation valuable to attackers. The use-after-free class of bug is well-understood and relatively straightforward to weaponize. Organizations should treat this as a critical mobile security issue and prioritize remediation within their patch cycle.

Risk score, explained

The CVSS 8.8 HIGH severity reflects the perfect storm of accessibility (network-reachable, user-clickable) and impact (full confidentiality, integrity, and availability compromise). While Chromium's internal severity is rated Low, CVSS accounts for exploitability and blast radius more comprehensively. An attacker with the ability to execute arbitrary code can read files, exfiltrate data, install malware, or modify system state. The AV:N/AC:L/PR:N/UI:R combination is particularly dangerous because it means any website visited or link clicked by any user can trigger the flaw—no special setup or privileges are required. The HIGH severity is appropriate and should drive immediate remediation.

Frequently asked questions