Google Chrome iOS CVE-2026-78957

Exploitation requires local access to the iOS device - the attacker cannot operate remotely. The user must interact with a crafted file (UI:R), meaning the victim must be induced to open or process a malicious file through Chrome on iOS. No elevated system privileges are required from the attacker (PR:N). The vulnerability is limited to the Mobile component of Chrome on the iOS platform; Android, macOS, Windows, and Linux Chrome instances are not within the stated scope of this CVE. The local attack vector combined with mandatory user interaction are the primary limiting factors for exploitation; opportunistic mass exploitation is not feasible given these constraints.

The overall real-world risk is low-to-moderate and significantly below what the CVSS Confidentiality:High metric alone might suggest. The local attack vector (AV:L) combined with mandatory user interaction (UI:R) means an attacker cannot remotely or autonomously exploit this - they need access to the target device and must trick the user into opening a malicious file. EPSS at 0.15% (4th percentile) confirms extremely low observed exploitation probability in the wild. CISA SSVC labels exploitation as 'none' and the vulnerability as not automatable, with only partial technical impact - these signals collectively indicate this is not a priority for most organizations relative to network-reachable or unauthenticated flaws. The CVSS score of 5.5 (Medium) reflects the real-world constraint of local access. There is no KEV listing and no public exploit identified. The primary concern is targeted abuse - e.g., a malicious actor with physical device access or a compromised local file delivery mechanism. Patch deployment is straightforward via Chrome auto-update.

A local attacker with access to the iOS device - either via physical access or through another app capable of writing files to shared storage - places a specially crafted file accessible to Chrome. When the user opens or processes this file within Chrome Mobile on iOS, the browser's information-handling path leaks sensitive data (such as cached credentials, browsing history fragments, or local storage contents) to the attacker-controlled context. No public proof-of-concept has been identified at time of analysis.