# CVE-2026-78935: Google Chrome use of uninitialized variable in Mobile

Source: https://junglewise.ai/threats/cve-2026-78935-google-chrome-use-of-uninitialized-variable-in-mobile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78935 · Severity: critical · CVSS 9.6 · Published 2026-08-25

Google Chrome for iOS contains a use-of-uninitialized-variable vulnerability in its Mobile component that allows attackers to execute arbitrary code outside the browser's security sandbox. An attacker can trigger this vulnerability by crafting a malicious HTML page and tricking a user into viewing it, potentially compromising user data and device security. This affects Chrome versions prior to 152.0.7977.65 on iOS.

Technologies: [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os), [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-78935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78935 being exploited in the wild.

**How severe is CVE-2026-78935?** Critical severity, with a CVSS score of 9.6, published 25 August 2026.

**Which products and versions are affected?** Google Chrome prior to 152.0.7977.65 on iOS.

**Is there a fix for CVE-2026-78935?** A patch was published on 2026-08-25: Fixed in Chrome 152.0.7977.65 for iOS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78935 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78935?** Check whether you run Apple Iphone Os or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-of-uninitialized-variable defect in Chrome's Mobile component (Chromium bug 522082472) that allows remote code execution outside the security sandbox. The attack vector is network-based, requiring no user authentication but requiring user interaction (opening a crafted HTML page). An attacker who successfully exploits this can achieve arbitrary code execution with implications beyond the sandbox boundary. The vulnerability has been patched in Chrome 152.0.7977.65 (released August 25, 2026 for iOS), and no public exploit was known at the time of advisory publication.

## Affected products

- Google Chrome prior to 152.0.7977.65 on iOS

## Timeline

- 2026-08-25: disclosed: Publicly disclosed via Chrome Releases blog and NVD
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65 for iOS

## References

- [https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html](https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html)
- [https://issues.chromium.org/issues/522082472](https://issues.chromium.org/issues/522082472)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)