CVE-2026-10896: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability in Google Chrome for iOS allows a remote attacker to execute arbitrary code by luring a user to a crafted HTML page. The flaw is reachable over the network with no authentication required, but does require the victim to visit a malicious or attacker-controlled webpage. Successful exploitation gives the attacker full code execution within the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target device must be able to reach an attacker-controlled or compromised webpage.

• AuthenticationNot required

  No account or credential of any kind is needed; any anonymous visitor to a malicious page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by-navigation scenario.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental conditions or race-window requirements on the attacker.

Blast Radius

• Attacker achieves arbitrary code execution inside the Chrome browser process on the victim's iOS device.
• Confidential data accessible to the browser, including stored credentials, session tokens, and browsing history, is exposed.
• Attacker can write or modify data within the browser's sandbox, including cached content and locally stored site data.
• The browser process can be crashed or rendered unresponsive, disrupting the user's session and any active web-based workflows.