Chrome for iOS CVE-2026-18011

Exploitation requires physical access to the iOS device - the CVSS vector AV:P is the definitive constraint. The attacker must be able to interact with the device directly; remote or network-based exploitation is not possible for this vulnerability. No authentication is required beyond physical access (PR:N), meaning a passcode-locked device may still present reduced but non-zero risk if the screen can be accessed (e.g., during a brief unattended moment). Exploitation is limited to iOS devices only; Chrome on other platforms is unaffected. The SSVC assessment of Automatable: no confirms no scripted or scalable delivery mechanism exists. Defenders can further bound risk by noting that exploitation yields only a partial confidentiality impact - sensitive data in memory is not guaranteed to be recoverable in full.

All risk signals converge on very low real-world priority. The CVSS 3.1 base score of 2.4 reflects AV:P (physical access required), C:L (limited confidentiality impact), and no integrity or availability impact. EPSS sits at 0.10% in the 1st percentile, indicating near-zero probabilistic exploitation in the near term. CISA SSVC confirms Exploitation: none, Automatable: no, and Technical Impact: partial - no attack chain can be scripted or delivered remotely. The vulnerability is not listed in the CISA KEV catalog and no public exploit or POC has been identified. The primary real-world scenario is an opportunistic or targeted attacker with hands-on device access, severely limiting the addressable threat population. For most enterprise deployments, this ranks below routine patching priority; for high-assurance environments handling sensitive data on shared or lost/stolen devices, the patch is still warranted.

An attacker with physical access to an unlocked or accessible iOS device running Chrome prior to 151.0.7922.72 triggers the inappropriate memory handling implementation, reading portions of Chrome's process memory. The extracted data could include cached credentials, authentication tokens, browsing history fragments, or other sensitive in-memory content depending on recent browser activity. No public exploit code exists, and the attack requires hands-on device interaction, limiting this to targeted theft, shared-device, or insider threat scenarios.