Executive brief
A security vulnerability exists in Google Chrome for iOS that could allow a remote attacker to execute malicious code on a user's device. To exploit this, an attacker must trick a user into visiting a specially crafted website and performing specific touch gestures or interactions. Successful exploitation could lead to a full compromise of the browser session and potential access to sensitive user data.
Technical details
A use-after-free (UAF) vulnerability exists in the iOS-specific implementation of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during specific UI interactions, allowing an attacker to reference memory after it has been freed. By convincing a user to visit a malicious HTML page and perform specific UI gestures, a remote attacker can achieve arbitrary code execution within the context of the browser process. This vulnerability is categorized as High severity by Chromium. Users are advised to update to version 149.0.7827.53 or later to mitigate this risk.
Affected products
- Google Chrome for iOS prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149 promoted to stable channel
- 2026-06-04: disclosed: CVE published by NVD