EUVD-2026-34548
GHSA-35jc-5h4r-p9cg
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome for iOS versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page that triggers a use-after-free condition. The flaw is rated Critical by Chromium and carries a CVSS 8.8 score, and while no public exploit is identified at time of analysis, the user-interaction-only barrier (visiting a page) makes drive-by exploitation a realistic concern for unpatched iOS Chrome users.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Assess Chrome adoption across iOS devices; notify stakeholders of patch urgency. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed iOS devices via MDM; direct unmanaged-device users to update immediately. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addIn
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigge
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to exploit a use-after-free cond
Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to break out of the renderer pro
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised t
Share
External POC / Exploit Code
Leaving vuln.today