# CVE-2026-10958: Google Chrome for iOS use after free in UI gestures

Source: https://junglewise.ai/threats/cve-2026-10958-google-chrome-for-ios-use-after-free-in-ui-gestures  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-10958 · Severity: info · CVSS 8.8 · Published 2026-06-04

A security vulnerability exists in Google Chrome for iOS that could allow a remote attacker to execute malicious code on a user's device. To exploit this, an attacker must trick a user into visiting a specially crafted website and performing specific touch gestures or interactions. Successful exploitation could lead to a full compromise of the browser session and potential access to sensitive user data.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-10958 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10958 being exploited in the wild.

**How severe is CVE-2026-10958?** Informational severity, with a CVSS score of 8.8, published 4 June 2026.

**Which products and versions are affected?** Google Chrome prior to 149.0.7827.53.

**Is there a fix for CVE-2026-10958?** A patch was published on 2026-06-02: Chrome 149 promoted to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10958 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10958?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the iOS-specific implementation of Google Chrome. The flaw is triggered when the browser incorrectly manages memory during specific UI interactions, allowing an attacker to reference memory after it has been freed. By convincing a user to visit a malicious HTML page and perform specific UI gestures, a remote attacker can achieve arbitrary code execution within the context of the browser process. This vulnerability is categorized as High severity by Chromium. Users are advised to update to version 149.0.7827.53 or later to mitigate this risk.

## Affected products

- Google Chrome for iOS prior to 149.0.7827.53

## Timeline

- 2026-06-02: patched: Chrome 149 promoted to stable channel
- 2026-06-04: disclosed: CVE published by NVD

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html)
- [https://issues.chromium.org/issues/507251069](https://issues.chromium.org/issues/507251069)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)