What is the CVSS score of CVE-2026-7897?

CVE-2026-7897 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome iOS are affected by CVE-2026-7897?

Google Chrome for iOS versions prior to 148.0.7778.96 contain a remote code execution vulnerability in the mobile UI handler that requires user interaction through specific gestures on malicious…. A patch is available.

How to fix or mitigate CVE-2026-7897?

Within 24 hours: Communicate mandatory Chrome update requirement to all iOS users and verify auto-update settings are enabled in device management policies. Within 7 days: Confirm Chrome for iOS has been updated to version 148.0.7778.96 or later across all managed and BYOD devices through MDM reporting. Within 30 days: Audit user browsing patterns and email gateway logs for suspicious content delivery; conduct targeted security awareness training on social engineering and phishing tactics that may be weaponized to deliver malicious pages.

Google Chrome iOS CVE-2026-7897

EUVD-2026-27897 HIGH

Use After Free (CWE-416)

2026-05-06 Chrome

Denial Of Service Use After Free Memory Corruption RCE Apple Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 00:30 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

May 06, 2026 - 18:12 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome for iOS prior to version 148.0.7778.96 through use-after-free memory corruption in the mobile UI handler. Exploitation requires convincing a user to perform specific UI gestures while viewing a malicious HTML page. Google confirms Critical severity and has released a patched version. EPSS data unavailable; not currently listed in CISA KEV. Attack complexity is rated High due to the required user interaction pattern, limiting opportunistic exploitation but enabling targeted attacks via social engineering.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Google Chrome's iOS-specific mobile UI implementation. Use-after-free occurs when code continues to use a memory pointer after the memory has been freed, allowing an attacker to manipulate the freed memory region and potentially redirect program execution. The iOS mobile platform uses distinct UI gesture handling compared to desktop Chrome, and this vulnerability exists specifically in that iOS mobile code path. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome browser. The Chromium issue tracker reference (504069514) indicates this was reported through Google's vulnerability research program.

RemediationAI

Update Google Chrome for iOS to version 148.0.7778.96 or later immediately. iOS users can update through the App Store or enable automatic app updates in iOS Settings > App Store > App Updates. Google's stable channel update announcement at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html confirms patch availability. No workarounds are provided by the vendor. Organizations managing iOS devices through MDM should push Chrome updates via their mobile device management platform. Until patched, compensating controls include instructing users to avoid clicking links from untrusted sources and exercising caution with unexpected prompts for UI gestures on unfamiliar web pages, though these behavioral controls provide limited protection against sophisticated social engineering. Disabling JavaScript would mitigate exploitation but severely degrades browser functionality for legitimate sites. Network-level blocking of known-malicious domains provides defense-in-depth but cannot prevent zero-day watering hole attacks.