CVE-2026-9956: Use after free in iOS in Google Chrome on iOS prior to 148

Synopsis

Use-after-free in Google Chrome on iOS (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code on the affected device. The vulnerability is reachable over the network but requires the attacker to convince a target user to perform specific UI gestures on a crafted HTML page; no prior authentication is needed. Successful exploitation gives the attacker full code execution within the browser process, combining confidentiality, integrity, and availability impact. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the targeted device must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or prior authentication is needed; the attacker only needs the victim to visit a malicious page.

• Victim interactionRequired

  The attacker must socially engineer the user into performing specific UI gestures within the crafted page before the vulnerability is triggered.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on environmental or timing factors beyond the attacker's direct control, such as specific memory layout conditions in the browser process.

Blast Radius

• The attacker executes arbitrary code within the Chrome browser process on the victim's iOS device.
• Confidentiality impact is high: the attacker reads browser memory, stored credentials, session tokens, and any data accessible to the Chrome process.
• Integrity impact is high: the attacker modifies in-process data, injects content, or writes to storage accessible by the browser.
• Availability impact is high: the attacker crashes or destabilizes the browser process, causing a denial of service to the user.