Is CVE-2026-78964 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78964 being exploited in the wild.

How severe is CVE-2026-78964?

Critical severity, with a CVSS score of 9.6, published 25 August 2026.

Which products and versions are affected?

Google Chrome prior to 152.0.7977.65 on iOS.

Is there a fix for CVE-2026-78964?

A patch was published on 2026-08-25: Fixed in Chrome 152.0.7977.65 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78964 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78964?

Check whether you run Apple Iphone Os or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78964: Google Chrome use after free in Sync on iOS

CVE-2026-78964 · Severity: critical · CVSS 9.6 · Published 2026-08-25

Google Chrome for iOS contains a memory safety vulnerability in its Sync feature that allows attackers to execute arbitrary code outside the browser's security sandbox by tricking users into visiting a malicious webpage. This could lead to complete compromise of user data stored on the device, including passwords, browsing history, and personal information, bypassing the security protections that normally isolate the browser from the rest of the system.

Technologies: Apple Iphone Os, Google Chrome. Vendors: Apple, Google.

Quick answers

Is CVE-2026-78964 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78964 being exploited in the wild.
How severe is CVE-2026-78964?: Critical severity, with a CVSS score of 9.6, published 25 August 2026.
Which products and versions are affected?: Google Chrome prior to 152.0.7977.65 on iOS.
Is there a fix for CVE-2026-78964?: A patch was published on 2026-08-25: Fixed in Chrome 152.0.7977.65 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78964 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78964?: Check whether you run Apple Iphone Os or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the Sync component of Google Chrome on iOS versions prior to 152.0.7977.65. The vulnerability can be triggered via a crafted HTML page delivered over the network, requiring user interaction (visiting a malicious webpage). Successful exploitation allows an attacker to execute arbitrary code outside the Chrome sandbox, bypassing the memory protection mechanisms that normally isolate the browser process. The issue was identified as part of Chrome 152's security update and has been patched in version 152.0.7977.65 and later.

Affected products

Google Chrome prior to 152.0.7977.65 on iOS

Timeline

2026-08-25: disclosed: Public disclosure via Chrome Releases blog
2026-08-25: patched: Fixed in Chrome 152.0.7977.65

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.