Google Chrome iOS EUVD-2026-65774

The vulnerability affects Chrome on iOS exclusively - users on Android, Windows, macOS, or Linux Chrome are not in scope. No authentication, user interaction, or user-initiated navigation is required; the attack is triggered solely by receiving crafted network traffic, meaning the victim device must be reachable by or initiating connections to an attacker-controlled network endpoint. High attack complexity (AC:H) limits exploitation: the attacker must reliably control heap layout to place controlled data at the freed memory address, which typically requires a race condition or a multi-step heap grooming sequence. This is not exploitable against default-isolated networks (e.g., devices behind strict NAT without outbound connections to attacker infrastructure). Chrome version must be strictly below 152.0.7977.65 on iOS.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.1, but the AC:H rating acknowledges that triggering a use-after-free reliably requires precise timing or specific heap state conditions. This complexity dampens opportunistic mass exploitation. However, the sandbox escape aspect suggests the vendor's S:U (unchanged scope) designation may understate impact - code execution outside the Chrome sandbox on iOS implies a scope change to the broader application environment, a discrepancy worth flagging. EPSS at 0.28% (20th percentile) is low, indicating exploitation has not yet been broadly observed. This vulnerability is not listed in the CISA KEV catalog as of this analysis. The combination of AC:H, no available public exploit, and low EPSS suggests this is primarily a priority for iOS users who cannot auto-update, rather than an emergency triage item for most organizations. The lack of UI:N mitigation means no social engineering step is required, which increases theoretical attractiveness to targeted threat actors.

A remote attacker positions themselves to deliver crafted network traffic to a victim running an unpatched Chrome on iOS - for example, via a malicious server response, a man-in-the-middle position on a shared network, or a WebRTC-based interaction. The crafted traffic triggers a use-after-free in Chrome's Mobile component, corrupting freed heap memory and redirecting execution to attacker-controlled code running outside the Chrome sandbox. No public proof-of-concept exists at time of analysis; successful exploitation requires achieving the precise heap state necessary for reliable UAF triggering, which AC:H reflects.