CVE-2026-9963: Uninitialized Use in iOS in Google Chrome on iOS prior to 148

Synopsis

Uninitialized memory use in Google Chrome on iOS (versions prior to 148.0.7778.216) allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must reach the victim over the network and convince them to perform specific UI gestures on a crafted HTML page; no credentials are required. Successful exploitation gives the attacker code execution within the Chrome sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's device over the network, delivering a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to visit a malicious page.

• Victim interactionRequired

  The victim must be socially engineered into performing specific UI gestures on the crafted page, making phishing or deceptive UI a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must account for timing, specific gesture sequences, or other environmental conditions that cannot be fully controlled, reducing exploit reliability.

Blast Radius

• Attacker achieves arbitrary code execution within the Chrome sandbox on the victim's iOS device.
• Confidentiality impact is high: sandbox-accessible data such as browsing history, cached credentials, and session tokens can be read.
• Integrity impact is high: the attacker can modify data and state within the sandbox, including stored site data and local app storage accessible to Chrome.
• Availability impact is high: the attacker can crash or destabilize the Chrome process, disrupting browser availability on the device.