Chrome for iOS CVE-2026-17967

Exploitation requires the victim to open an attacker-controlled crafted HTML page in Chrome for iOS on a version earlier than 151.0.7922.72 - that user interaction (UI:R in the CVSS vector) is the key limiting factor; the attack cannot fire unless the user navigates to the malicious content, and SSVC accordingly marks it not automatable. No authentication or special privileges are needed (PR:N) and no non-default configuration is required, but exploitation is described as only potential, the Chromium-assigned severity is Low, and there is no public exploit, so realistic risk is constrained by the need for social engineering to deliver the page and by the platform being iOS Chrome specifically.

Signals conflict and should be weighed carefully. The provided CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R with C:H/I:H/A:H) implies a high-impact, low-complexity, unauthenticated remote issue, yet Chromium itself assigned a security severity of Low, and the description hedges with 'potentially exploit heap corruption,' suggesting reliable code execution is not demonstrated. Corroborating the lower-urgency read: EPSS is only 0.21% (11th percentile), SSVC lists Exploitation=none and Automatable=no (user interaction is required, so it cannot be mass-automated), and there is no KEV listing and no public exploit identified. The one signal pushing higher is SSVC Technical Impact=total, consistent with a memory-corruption primitive that could in principle yield full compromise. Net: this is a patch-in-normal-cycle browser memory-safety bug, not an emergency - the high CVSS is driven by theoretical worst-case impact while every real-world exploitation signal (EPSS, SSVC exploitation, KEV absence, no POC, vendor Low severity) points to low current risk. The C:H/I:H/A:H rating is worth verifying against the vendor's Low severity call.

An attacker hosts a malicious web page and lures a Chrome for iOS user to open it via a phishing message, malicious ad, or compromised site; when the page renders, it manipulates object lifetimes to trigger the use-after-free and corrupt the heap, potentially leading to code execution or a crash. Exploitation requires that single user interaction (visiting the page) and no authentication, but no public proof-of-concept has been identified and reliable exploitation is characterized only as potential.