CVE-2026-10958: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability affects Google Chrome for iOS in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a user to perform specific UI gestures on a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution on the device. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected Chrome for iOS instance must be reachable or browsing content from an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker who can serve a page to the target can attempt the exploit.

• Victim interactionRequired

  A user must be convinced to perform specific UI gestures while viewing a crafted HTML page, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout guessing, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the Chrome for iOS process on the victim's device.
• With code execution, the attacker reads local app data accessible to Chrome, including cached credentials, cookies, and browsing history.
• The attacker can write or modify files within the Chrome app sandbox, enabling persistent payload installation or data tampering.
• The attacker can crash or destabilize the Chrome process, causing service disruption for the affected user.