EUVD-2026-50937
GHSA-q82x-xxqm-x669
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Physical access is the sole prerequisite (AV:P); no authentication needed; only partial confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Low)
AnalysisAI
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
Technical ContextAI
The flaw is rooted in CWE-200, an inappropriate implementation within Chrome's iOS-specific code path that insufficiently restricts access to process memory contents. On iOS, Chrome operates within Apple's application sandbox, but the inappropriate implementation allows a local attacker with physical device access to read memory that should be protected. CPE data identifies the affected component as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to iOS versions prior to 151.0.7922.72. The Chromium security team rated this severity as Low, consistent with the physical-access prerequisite and limited confidentiality impact - the attacker gains partial read access to process memory but cannot modify data or cause a denial of service.
RemediationAI
The primary fix is upgrading Chrome for iOS to version 151.0.7922.72 or later, available through the Apple App Store. The vendor advisory confirming this patch is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No functional workaround exists that eliminates the vulnerability while retaining Chrome on iOS; organizations requiring immediate risk reduction before patching can enforce Mobile Device Management (MDM) policies to restrict physical access - for example, requiring device encryption and screen lock with short timeout, and enabling remote wipe capability for lost or stolen devices. These compensating controls do not remediate the flaw but reduce the attacker's window of opportunity during physical access. The trade-off is operational friction for end users due to stricter lock screen policies.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today