EUVD-2026-40591
GHSA-pv63-hmm6-8rwc
Severity by source
AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access required (AV:P), race-condition timing dependency justifies AC:H; only confidentiality impacted as memory is read but not modified or destroyed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Medium)
AnalysisAI
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the target iOS device is the absolute prerequisite (AV:P); remote or network exploitation is not possible for this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.2 with vector AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects a constrained threat profile: physical device access (AV:P) is the binding prerequisite, and high attack complexity (AC:H) means the attacker must reliably trigger and win a timing race - not a trivial task. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who gains brief physical access to an iOS device - for example, while the device is unattended or during a border inspection - opens Chrome and triggers a specific concurrent operation to create the race condition window. By precisely timing interaction with Chrome's internal shared memory state during that window, the attacker reads process memory contents that may include cached credentials, browsing session data, or other sensitive in-memory artifacts. … |
| Remediation | Update Google Chrome for iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed patch as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today