What is the CVSS score of EUVD-2026-33105?

EUVD-2026-33105 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome iOS are affected by EUVD-2026-33105?

Google Chrome on iOS versions below 148.0.7778.216 are vulnerable to remote code execution attacks triggered through crafted web pages, directly impacting any employee using Chrome on mobile devices.. A patch is available.

How to fix or mitigate EUVD-2026-33105?

Within 24 hours: quantify Chrome iOS deployment using MDM data and identify high-risk user segments (finance, executive, engineering teams). Within 7 days: deploy forced update to Chrome iOS v148.0.7778.216 or later via app store or MDM controls. Within 30 days: validate 100% patch adoption through MDM telemetry and document enforcement controls.

Google Chrome iOS EUVD-2026-33105

| CVE-2026-9963 HIGH

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-5cq6-2qjf-7mh7

RCE Google Apple

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:30 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution within the sandbox in Google Chrome on iOS prior to 148.0.7778.216 allows remote attackers to abuse an uninitialized memory condition when a victim performs specific UI gestures on a crafted HTML page. Chromium rates the security severity as High, and a vendor patch is available; no public exploit identified at time of analysis and the EPSS score (0.04%) suggests low near-term exploitation likelihood.

Technical ContextAI

The flaw is classified as CWE-457 (Use of Uninitialized Variable), a memory-safety class where a variable or memory region is read before being explicitly initialized, producing attacker-influenceable values that can corrupt control flow or leak data. The affected component is the iOS build of Google Chrome (cpe:2.3:a:google:chrome:*), which on iOS is constrained to Apple's WebKit-based WKWebView rendering due to App Store policy - meaning the bug is most likely in Chrome's iOS-specific UI/glue code that handles gesture input and HTML content rather than in the Blink renderer used on other platforms. Execution remains confined to Chrome's iOS sandbox (Scope: Unchanged in the CVSS vector).

RemediationAI

Vendor-released patch: Google Chrome for iOS 148.0.7778.216 - upgrade via the App Store as referenced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html) and confirm the installed build in Chrome's About screen. No vendor-published workaround exists; as compensating controls while updates roll out, restrict use of Chrome on iOS to trusted sites only (the bug requires loading a crafted HTML page), or temporarily route iOS users through Safari, which uses the same WebKit engine but is not affected by this Chrome-specific code path - the trade-off is loss of Chrome sync/features and added user friction. Enterprise MDM operators should push the App Store update and track compliance, since the exploit requires UI gestures that end users may inadvertently perform.