CVE-2026-10885: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability in Google Chrome for iOS versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code. The flaw is reachable over the network with no authentication required, but it does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker full code execution within the browser process, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's device over the network, delivering a crafted HTML page through a web request.

• AuthenticationNot required

  No account or credentials are needed; the attacker interacts with the victim's browser directly through a web page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page controlled by the attacker, making social engineering a necessary part of exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker executes arbitrary code within the Chrome browser process on the victim's iOS device.
• All data accessible to the browser, including stored credentials, session cookies, and browsing history, can be read by the attacker.
• The attacker can modify browser state, inject content into pages, or tamper with data the browser reads and writes.
• The browser process can be crashed or rendered unresponsive, disrupting the user's session and any active web applications.