CVE-2026-10952: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability affects Google Chrome for iOS in versions prior to 149.0.7827.53. The flaw is reachable over the network without any authentication, but requires a user to visit a crafted HTML page. Successful exploitation gives the attacker full read, write, and crash capability over the renderer process through heap corruption, enabling data theft, content tampering, or application crash. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making any internet-exposed browsing session a viable attack surface.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load a page the attacker controls.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, requiring a social-engineering or malicious-link delivery step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race conditions or specific memory layout.

Blast Radius

• Reads in-process memory from the Chrome renderer, exposing session tokens, cookies, and page content belonging to the current user.
• Writes to freed heap memory, allowing an attacker to corrupt renderer state and inject attacker-controlled data into the running process.
• Crashes the Chrome for iOS application by triggering heap corruption, causing immediate denial of service for the affected user session.
• Heap corruption at this severity level can chain into code execution within the renderer sandbox, enabling further privilege escalation attempts.