CVE-2026-10915: Use after free in Core in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability in the Core component of Google Chrome on iOS (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a specially crafted HTML page. The attack is delivered over the network and requires the victim to visit a malicious page, but does not require the attacker to be authenticated. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by hosting a crafted HTML page the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential is needed on the targeted system; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making social engineering or malicious ad delivery the expected delivery mechanism.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must first have compromised the renderer process before this use-after-free can be leveraged for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• A successful attacker escapes the Chrome sandbox on the iOS device, gaining code execution in a more privileged process context.
• The attacker reads data protected by the sandbox boundary, including session tokens, cookies, and locally cached content.
• The attacker can write or modify data accessible to the elevated process, tampering with stored files or application state.
• The attacker can crash or destabilize processes outside the sandbox, causing service disruption to the browser and potentially other device components.