CVE-2026-14099: Critical Use-After-Free in Chrome on iOS – Patch Now

Technical summary

CVE-2026-14099 is a use-after-free (CWE-416) vulnerability in Chrome's iOS renderer or JavaScript engine. The flaw occurs when the browser references memory that has already been freed, allowing an attacker to overwrite that memory region with controlled data. By hosting a malicious HTML page and convincing a user to interact with specific UI elements (buttons, inputs, or gestures), the attacker can trigger the dangling pointer dereference. This leads to heap corruption, which can be chained to arbitrary code execution. The Chromium security team rated this as Low severity, but the CVSS 3.1 score of 8.8 reflects the full impact potential given user interaction dependency.

Business impact

If you use Chrome on iOS for sensitive operations—banking, email, corporate access—a successful exploit could result in credential theft, session hijacking, or unauthorized access to sensitive information. The attack surface is limited because it requires user interaction and a web visit, but iOS users may be less cautious about visiting untrusted sites compared to desktop users. The reputational and regulatory risk depends on whether your organization mandates Chrome on iOS or relies on it for secure communication.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are vulnerable. The underlying iOS OS version does not directly matter, but the attack runs within the Chrome sandbox on Apple iOS. Any user running an affected Chrome build is at risk if they visit a malicious website and interact with crafted UI elements.

Exploitability

Exploitation requires user interaction: an attacker must convince the user to visit a malicious website and perform specific UI gestures (taps, scrolls, or form interactions). There is no evidence of in-the-wild active exploitation (not on KEV list). The attack is feasible for a determined attacker with knowledge of iOS memory layout, but it is not trivial. The user interaction requirement significantly raises the barrier compared to network-only exploits. Phishing campaigns targeting Chrome on iOS users with malicious links could enable this attack at scale.

Remediation

Update Chrome on iOS to version 150.0.7871.47 or later immediately. Go to the App Store, search for Chrome, and check for available updates. If your organization manages iOS devices via MDM, push the Chrome update to all enrolled devices. Verify the update has been applied by checking Chrome's About page (menu > Settings > About Chrome).

Patch guidance

Patch version 150.0.7871.47 or later resolves this vulnerability. Users should enable automatic app updates in the iOS App Store settings to receive patches without manual action. Organizations should verify patch deployment through MDM reporting. There are no known workarounds other than avoiding untrusted websites while running unpatched versions.

Detection guidance

Monitor for Chrome crashes on iOS devices that correlate with user browsing activity—heap corruption often leads to a crash. If you have mobile device management with event logging, look for Chrome process terminations followed by system reboots. Endpoint detection and response solutions focused on iOS may flag unusual memory access patterns, though detection is limited without kernel-level visibility. Network detection is not practical because the malicious payload is delivered via HTTPS. Consider user education on phishing risks until patches are deployed.

Why prioritize this

This vulnerability merits urgent patching because it combines a high CVSS score (8.8) with potential for full device compromise. Although user interaction is required, the low complexity of the attack once triggered and the high impact justify rapid remediation. Organizations relying on Chrome on iOS for work should prioritize this patch above routine updates. The fact that it is not yet on the KEV list does not diminish its risk—Chromium Low severity ratings sometimes underestimate real-world impact when memory corruption is involved.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects the attack vector (network), low attack complexity, no privilege requirement, required user interaction, and high impact across confidentiality, integrity, and availability. The Chromium security team labeled this Low severity, likely because use-after-free in a sandboxed renderer is constrained. However, the CVSS vector accounts for the potential to escape the sandbox or combine with other flaws to achieve full device compromise. For a mobile environment where a single device may hold financial accounts and corporate credentials, the impact rating justifies the high score.

Frequently asked questions