CVE-2026-10961: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

A use-after-free vulnerability affects Google Chrome for iOS in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, though it demands that the attacker has already compromised the renderer process and that the victim interacts with a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker the ability to read sensitive data, tamper with content, and crash or disrupt the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the affected service must be reachable from a remote origin.

• AuthenticationNot required

  No credentials or account are needed; the attack is initiated by an unauthenticated remote attacker.

• Victim interactionRequired

  The victim must open or be directed to a crafted HTML page, making this a social-engineering-dependent attack requiring at least one user action.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must have already compromised the renderer process before leveraging this flaw for a sandbox escape, introducing a significant prerequisite condition.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, breaking the primary isolation boundary that separates web content from the underlying OS.
• With sandbox escape achieved, the attacker reads sensitive data accessible to the browser process, including stored credentials, session tokens, and browsing history.
• The attacker can modify browser state or inject content into contexts outside the compromised renderer, enabling tampering with data the user views or submits.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.