Chrome for iOS CVE-2026-78981

Exploitation requires the attacker to have a program executing locally on the target iOS device, meaning a malicious application must already be installed and running on the same device as the vulnerable Chrome for iOS instance. The victim must be using Google Chrome for iOS (not Safari or another browser), and the device must be running Chrome prior to version 152.0.7977.65. Exploitation is NOT automatable per SSVC and does NOT appear to require network reachability. Factors limiting exploitation: physical or logical access to the iOS device is a prerequisite; Apple's App Store review process and iOS sandboxing impose barriers to deploying the malicious local program; no privileges beyond normal app-level execution are implied. The AV:N designation in the NVD CVSS vector conflicts with these conditions and should not be relied upon for access-vector assessment.

Conflicting signals require explicit attention. The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) implies a network-accessible, unauthenticated attack requiring only user interaction, which directly contradicts the CVE description specifying a local attacker using a local program - this discrepancy should be verified with the vendor before using the NVD score for prioritization. SSVC rates exploitation as none and technical impact as partial, aligning more credibly with the description. EPSS of 0.18% (7th percentile) reflects very low exploitation probability. Chromium's own severity classification is Low. Taken together, the realistic risk is substantially below what the 6.5 CVSS score implies: exploitation requires local device access, a co-resident malicious application, and only yields confidentiality impact with no integrity or availability loss. Additionally, the sole Chrome Releases reference URL is labeled 'stable-channel-update-for-desktop,' which is inconsistent with an iOS-specific vulnerability - the scope of affected platforms should be independently confirmed.

An adversary distributes a malicious iOS application - potentially through side-loading or a compromised enterprise distribution profile - that, once installed alongside Chrome for iOS on the victim's device, runs a local program to read sensitive information inadvertently exposed by Chrome's Mobile subsystem. The attacker gains access to the leaked data (browsing artifacts, credentials, or session tokens, depending on what Chrome fails to protect) without any network interaction. No public exploit or proof-of-concept code is known at time of analysis.