CVE-2026-9956: Chrome iOS Use-After-Free Remote Code Execution Vulnerability

Technical summary

This vulnerability stems from a use-after-free condition (CWE-416) in Chrome's iOS implementation, where memory is accessed after it has been freed. The flaw is triggered through crafted HTML served over the network. The attack requires the user to perform specific UI gestures, which the attacker must socially engineer or induce through deceptive page design. Once triggered, the freed memory can be controlled to execute arbitrary code with the privileges of the Chrome process.

Business impact

Successful exploitation could allow attackers to compromise user data, install malware, or escalate to further system compromise on iOS devices. Given Chrome's extensive use on iPhones for browsing, phishing attacks that combine social engineering with malicious landing pages pose a meaningful risk to enterprise users and customers who rely on mobile browsing for business tasks.

Affected systems

Google Chrome on iOS versions prior to 148.0.7778.216 are vulnerable. The vulnerability also involves Apple iPhone OS as the underlying platform. Organizations with iOS-using employees or customers should treat Chrome browser security as part of their mobile security posture.

Exploitability

Exploitation is feasible but not trivial. An attacker must host a crafted HTML page and convince or trick users into visiting it and performing specific UI interactions. This is more complex than pure drive-by exploitation but remains credible via phishing, malicious advertising, or social engineering. The requirement for user gesture interaction reduces (but does not eliminate) the risk of mass exploitation.

Remediation

Update Google Chrome on iOS to version 148.0.7778.216 or later. Users should enable automatic updates for Chrome and verify their current version via Settings > Google Chrome > About. Organizations should communicate update guidance to iOS users and consider mobile device management (MDM) policies that enforce Chrome version requirements or restrict older versions.

Patch guidance

Verify current Chrome version on iOS devices by navigating to Chrome Settings > About Google Chrome. The app will display the installed version and automatically check for updates. Force an update check if needed. For enterprise deployments, use MDM solutions to push Chrome updates or create compliance policies requiring minimum version 148.0.7778.216. Test updates on non-production devices first if your environment is highly controlled.

Detection guidance

Detection is challenging at the endpoint level since the exploit is memory-based and leaves minimal forensic artifacts. Monitor for: (1) unexpected Chrome crashes on iOS, particularly correlated with specific websites; (2) unusual outbound connections from Chrome processes; (3) sudden app restarts or device reboots after specific user actions. At the network level, watch for suspicious HTML served from known malicious or recently compromised domains. Correlate with threat intelligence feeds tracking use-after-free exploits in Chrome.

Why prioritize this

This vulnerability merits prompt patching due to the combination of remote attack vector, user interaction requirement that is socially feasible, and high-impact consequences (arbitrary code execution). While not yet in active exploitation tracking (KEV status is false), the low barrier to weaponization and the prevalence of Chrome on iOS make it a meaningful risk. Prioritize organizations with BYOD policies or customer-facing mobile apps built on iOS.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a remote attack vector with high complexity (due to required UI gestures), requiring user interaction, and no privileges needed. The impact is severe: confidentiality, integrity, and availability are all fully compromised if exploitation succeeds. The high complexity score moderately reduces the base score, but the attack remains credible and impactful enough to warrant prioritization above lower-severity vulnerabilities.

Frequently asked questions