EUVD-2026-40591
GHSA-pv63-hmm6-8rwc
Severity by source
AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access required (AV:P), race-condition timing dependency justifies AC:H; only confidentiality impacted as memory is read but not modified or destroyed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Medium)
AnalysisAI
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Technical ContextAI
CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) describes a race condition where two or more threads or processes access shared memory without adequate locking, creating a brief window during which data in an inconsistent or sensitive state can be observed. On iOS, Chrome runs within Apple's strict sandbox and process isolation model, which normally constrains cross-process memory access; however, this flaw creates an internal race within Chrome's own process that is reachable through physical interaction with the device. The CVSS vector's AV:P assignment confirms the attack surface is confined to physical proximity - remote or network-based exploitation is not applicable. The affected product range is all Google Chrome iOS builds prior to 150.0.7871.47, as reported by the ENISA EUVD (EUVD-2026-40591) and the Chromium issue tracker (issue 504192688).
RemediationAI
Update Google Chrome for iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed patch as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Prior to patching, the most effective compensating control is enforcing strict physical device security: enable full-disk encryption (active by default on modern iOS), configure a strong passcode or biometric lock, and enable auto-lock with the shortest tolerable timeout - these controls eliminate the physical access prerequisite. Organizations managing iOS fleets via MDM can enforce these policies centrally. Disabling Chrome's background refresh in iOS Settings may marginally reduce concurrent process activity, narrowing the race window, though this trade-off affects browser performance and is not a reliable mitigation. No trade-offs exist for simply updating the app.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today