EUVD-2026-105434
GHSA-v4hq-r5wm-jfw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Navigation
-
ExecutionCorrupt renderer heap memory
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated exploitation against Google Chrome on iOS versions prior to 156.0.8078.47, triggered when the victim navigates to or loads a crafted HTML page - the use-after-free is in the Navigation component, so the condition is simply processing attacker-controlled page navigation. Key limiting factors: it REQUIRES user interaction (the victim must open the malicious page, per UI:R), and resulting code execution is CONFINED to the renderer sandbox (S:U), meaning full-device compromise additionally requires a separate sandbox-escape vulnerability. No special non-default configuration is needed; any affected iOS Chrome build is exposed. |
| Impact | This is a genuine patch-priority issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivial barrier for a browser. CWE-416 use-after-free in the Navigation component is a classic memory-corruption primitive that Chromium historically rates High. Tempering the raw score: the vendor explicitly states code execution occurs 'inside the sandbox' (consistent with S:U, no scope change), so a successful exploit is contained to the renderer sandbox and requires a separate sandbox-escape chain to achieve full device compromise. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this is no public exploit identified at time of analysis. Net: a high-severity, easily-reachable memory-corruption bug in an extremely widespread browser, fully patched, with no current exploitation signal - prioritize patching but it is not yet a drop-everything KEV-class threat. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (via a malicious link, ad, or compromised site) and lures an iOS Chrome user to open it. The page triggers a use-after-free in the Navigation logic, corrupting memory to execute attacker-controlled code within the renderer sandbox. No public exploit code is identified at this time, and the attack requires user interaction (visiting the page) per the CVSS UI:R metric. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome on iOS before 156.0.8078.47 enables remote attackers to execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the page), and code execution is confined to the sandbox, so full-device compromise would need an additional sandbox escape. Google has released a vendor patch; no public exploit code or active exploitation was identified at time of analysis.
RemediationAI
Upgrade Google Chrome on iOS to version 156.0.8078.47 or later via the Apple App Store, and verify the installed version in Chrome settings. Enterprises should enforce a minimum app version through MDM and monitor the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. If immediate update is not possible, reduce exposure by restricting browsing to trusted sites and disabling JavaScript for untrusted content where feasible-recognizing that these are partial mitigations with usability impact and do not replace patching. No vendor workaround is documented; the primary fix is the 156.0.8078.47 update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Navigation component on iOS. Navigation code manages page loads, history transitions, and related renderer state; a crafted HTML page can cause an object to be freed while a stale reference remains, leading to memory corruption that an attacker can shape into arbitrary code execution in the renderer process. Because the affected component runs within Chrome's iOS sandbox, the immediate impact is limited to the renderer context unless chained with a separate sandbox-escape vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms remote, unauthenticated attack with user interaction and high confidentiality, integrity, and availability impact within the vulnerable component.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted page is network-delivered and unauthenticated (AV:N/PR:N) but needs the victim to open it (UI:R); code runs in-sandbox so no scope change (S:U) with high in-sandbox C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome on iOS before version 156.0.8078.47 contains a high-severity use-after-free flaw that could allow a crafted webpage to execute code within the browser sandbox, affecting employees who browse on managed iPhones and iPads. No public exploit or active exploitation was identified at time of analysis, and Google has released a fixed version, so this is primarily a mobile patch-management and user-awareness priority rather than an active incident. Leadership should care because unpatched mobile browsers can create avoidable operational exposure across the workforce.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB