CVE-2026-10951: Use after free in Autofill in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability exists in the Autofill component of Google Chrome on iOS in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a victim to perform specific UI gestures on a crafted HTML page, triggering heap corruption. Successful exploitation gives an attacker full read, write, and crash capability over the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's device must be reachable to or browsing from a network-accessible origin.

• AuthenticationNot required

  No account or credential is needed; any anonymous remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must perform specific UI gestures (such as interacting with Autofill prompts) on the attacker-controlled page, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other unpredictable environmental factors.

Blast Radius

• Reads arbitrary heap memory in the Chrome browser process, exposing stored autofill data, session tokens, and page content.
• Writes to freed heap memory, enabling attacker-controlled data to corrupt browser process state.
• Crashes the Chrome browser process on the affected iOS device, causing an unrecoverable session loss.
• Full compromise of the renderer or browser process context is achievable, potentially exposing all data visible within the active browsing session.