CVE-2026-9963: Chrome iOS Uninitialized Memory RCE—Patch Now

Technical summary

CVE-2026-9963 is an uninitialized use-after-free or memory access vulnerability (CWE-457) occurring in iOS-specific code paths within Chromium's rendering or JavaScript engine. The flaw manifests when a user interacts with page elements through specific gestures (tap, swipe, or similar UI actions) on attacker-controlled HTML. The uninitialized memory state allows code execution within the browser process sandbox. Chrome's sandboxing architecture mitigates full system compromise, but sandbox escapes remain a secondary risk. The issue is tracked as high severity by the Chromium security team.

Business impact

For organizations supporting iOS users accessing internal web applications or relying on Chrome for mobile browsing, this vulnerability can lead to session hijacking, credential theft, and unauthorized access to sensitive data rendered in the browser. While sandboxed execution limits OS-level attacks, compromised browser state may leak authentication tokens, personal information, and enterprise data. Business continuity risks include widespread mobile device compromise if users run unpatched versions across a fleet. Regulatory exposure exists for organizations handling regulated data on unpatched mobile browsers.

Affected systems

The vulnerability affects Google Chrome on iOS versions 148.0.7778.215 and earlier. Chrome on Android and desktop platforms are not affected by this iOS-specific memory initialization flaw. However, any organization with BYOD policies or employee-owned iPhones running unpatched Chrome faces exposure. Users on iOS 16 and later with current Chrome updates are protected; those on older Chrome builds or in organizations with slow patch cycles remain at risk.

Exploitability

Exploitation requires convincing a user to visit a malicious webpage and interact with it through specific UI gestures. This is a moderate bar—not as trivial as a drive-by download, but realistic in phishing campaigns, watering-hole attacks, or compromised advertising networks. No privilege escalation is needed; the attacker merely needs user engagement. The requirement for specific gestures (rather than passive page load) suggests the flaw is tied to event-handling or touch-input processing. Exploit code is not publicly known at this time, but the Chromium team classified it as 'High' severity, indicating development teams likely have internal proofs-of-concept.

Remediation

Update Google Chrome on iOS to version 148.0.7778.216 or later immediately. iOS users should enable automatic app updates in the App Store settings to prevent future delays. Organizations should audit mobile device management (MDM) policies to enforce Chrome version minimums and restrict access from older builds. For enterprises deploying internal web applications, consider server-side protections such as strict Content Security Policy headers and input validation to reduce attack surface. Monitor for any unusual browser process behavior on managed devices.

Patch guidance

Google Chrome on iOS is updated through the Apple App Store. Users with manual update settings should open the App Store, navigate to their profile, and force-check for Chrome updates. Organizations using Mobile Device Management (MDM) solutions (Jamf, Microsoft Intune, etc.) can push Chrome updates to managed devices; consult your MDM vendor's documentation for Chrome version control policies. Verify the installed version in Chrome Settings > About Google Chrome, which displays the current build number. Devices running iOS 15 or earlier may face compatibility constraints; confirm that Chrome 148.0.7778.216 is installable on your target iOS versions before enforcement.

Detection guidance

Monitor for suspicious Chrome process crashes or high memory consumption on employee iOS devices, which may indicate exploitation attempts. Network-level detection is limited since traffic is encrypted (HTTPS); however, watch for unusual user-agent patterns or requests to known malicious domains from iOS Chrome clients. Endpoint Detection and Response (EDR) tools on macOS or Android cannot directly monitor iOS, but organizations can use MDM console logs to track Chrome versions and flag devices running vulnerable builds. User reports of unexpected browser behavior, page crashes, or device slowness after visiting specific sites warrant investigation. Analyze web server logs for requests with suspicious payloads or unusual touch event patterns if you host web applications.

Why prioritize this

This vulnerability merits urgent priority due to its high CVSS score (7.5), the requirement for no special privileges, and the prevalence of iOS devices in both consumer and enterprise environments. While exploitation requires user interaction, the bar is relatively low in phishing and watering-hole scenarios. The lack of KEV designation suggests CISA has not yet flagged active exploitation, but widespread availability of unpatched Chrome users makes this an attractive target. Organizations with significant iOS user bases should prioritize patching within 48–72 hours; others within 2 weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) reflects attack complexity of 'High' due to the need for specific user gestures, but full impact on confidentiality, integrity, and availability within the sandbox scope. The score appropriately captures the practical risk: an attacker cannot silently exploit this via drive-by attack, but does gain substantial control over user data and browser state if user interaction is achieved. The sandbox constraint (S:U) prevents full system takeover, preventing a Critical rating, but the ability to execute arbitrary code and access user credentials justifies the High classification.

Frequently asked questions