EUVD-2026-105686
GHSA-hhx7-cv5c-345q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in renderer
-
ExecutionExecute arbitrary code in sandbox
-
ImpactAccess or corrupt renderer process data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome for iOS at a version prior to 156.0.8078.47 to open an attacker-crafted HTML page (UI:R), which triggers the use-after-free during rendering; no authentication is required (PR:N). Limiting factors that reduce realistic risk: the user must actively navigate to or load the malicious page (no zero-click/drive-by guaranteed), the flaw affects only the iOS build of Chrome, and resulting code execution is confined 'inside the sandbox' (S:U) - a separate sandbox-escape vulnerability would be needed to compromise the broader device or OS. |
| Impact | Signals conflict and should be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw requiring only that a victim open a crafted page - a classic high-scoring browser bug. However, Google/Chromium rated this issue's security severity as 'Low', and the description explicitly scopes code execution to 'inside the sandbox' (S:U, no sandbox escape), which materially lowers real-world impact versus the 8.8 number; this CVSS-vs-vendor-severity divergence should be flagged to stakeholders. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified in the input, so this is 'no public exploit identified at time of analysis' and not confirmed exploited. UI:R (user must visit a malicious page) further limits mass, automatic exploitation. Net: a patchable browser memory-corruption bug worth routine prioritization via normal Chrome update cadence, but - absent KEV, POC, or EPSS data and given the vendor 'Low' rating and sandbox containment - not an emergency-priority, drop-everything issue. Prioritize patching but treat the raw 8.8 as an upper bound pending the missing exploitation-probability data. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing JavaScript/HTML crafted to trigger the use-after-free, then lures a user running a vulnerable Chrome for iOS build (prior to 156.0.8078.47) to visit it. When the page is rendered, the freed object is reused, potentially allowing the attacker to execute arbitrary code within the renderer sandbox. No public proof-of-concept was identified in the available data, and exploitation requires the victim to navigate to the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free memory corruption in Google Chrome for iOS prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attacker needs no credentials but must convince the target to open a malicious page, and any resulting code execution stays confined to the Chrome sandbox on iOS - escaping to the underlying device would require a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the risk picture is mixed: Google's Chromium team rates the flaw Low severity, while the CVSS 3.1 base score computes to 8.8 because of the high confidentiality, integrity and availability impact assumed for successful code execution; a vendor patch (156.0.8078.47) is available, so prioritization should weigh the Low vendor rating against the 8.8 vector rather than treating either signal as authoritative.
RemediationAI
Vendor-released patch: upgrade Google Chrome for iOS to version 156.0.8078.47 or later from the App Store; this is the only complete fix, since the defect is a memory-safety flaw in shipped binary code and cannot be corrected by configuration. Enforce the update on managed fleets through MDM App Store volume purchasing or managed app update policies, and verify the reported version string on a sample of devices because iOS auto-update is frequently deferred. Details are in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/480153486. Where immediate patching is not possible, compensating controls are limited and each carries trade-offs: restrict browsing to a managed allowlist so users cannot reach untrusted pages (breaks general web access and depends on a proxy or DNS filtering that is hard to enforce on iOS), disable or restrict JavaScript and JIT-heavy content via an MDM content filter (degrades or breaks most modern web applications), or confine high-risk browsing to a separate managed browser profile with no access to corporate SSO sessions (reduces the value of code execution but does not remove it). Because the sandbox limits impact to the Chrome process, ensuring the browser holds no long-lived privileged sessions - short session lifetimes and re-authentication for sensitive apps - meaningfully reduces the blast radius while patching completes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416) in the Chrome for iOS rendering path, reached while processing a crafted HTML page. A use-after-free occurs when the browser frees a heap object - typically a DOM node, layout object, or renderer-side buffer - but retains a dangling reference that is later dereferenced; an attacker who can shape heap layout after the free can reuse the freed memory with controlled contents and redirect execution, producing memory corruption and potentially arbitrary code execution. On iOS, Chrome is built on WebKit/WKWebView rather than the full Chromium Blink engine, so the defect is specific to the iOS build and its integration layer rather than to desktop Chrome or Android. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H places the impact within the Chrome process's own security scope (S:U), meaning the sandbox remains the boundary: code execution gained this way runs with Chrome's privileges, not the device's, and Apple's iOS application sandbox plus the WebContent process isolation further constrain post-exploitation reach. The Chromium security severity of Low, contrasted with the 8.8 computed score, likely reflects an assessment that practical exploitation is difficult or requires unusual heap grooming, while the CVSS formula mechanically scores the worst-case C/I/A impact.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must load it (UI:R); code execution stays within the renderer sandbox (S:U) yet fully compromises that process (C/I/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Articles & Coverage 1
Executive ViewAI
Google Chrome for iOS releases prior to 156.0.8078.47 carry a use-after-free flaw that could allow a crafted webpage to execute code inside the browser sandbox, putting employees who browse on iPhones and iPads at potential risk. Exploitation requires the user to open a malicious page and any code execution stays confined to the Chrome sandbox, so the practical organizational exposure is limited despite the elevated CVSS score. Leadership should still prioritize remediation because mobile browsers are a frequent target for phishing-driven attacks and unpatched devices widen the attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB