Google Chrome EUVD-2026-66089

Exploitation requires the victim to open attacker-controlled web content in Google Chrome on iOS at a version below 152.0.7977.65 - the CVSS UI:R metric confirms mandatory user interaction (visiting/rendering a crafted HTML page). PR:N indicates no authentication is required of the attacker. Limiting factors: the target must be running the unpatched iOS Chrome build specifically, the user must actively navigate to the malicious page, and reliable exploitation of a use-after-free typically depends on winning a heap-reuse race and defeating memory mitigations, which makes weaponization non-trivial despite the AC:L rating; the Sync feature being active is the relevant code path.

The signals conflict and should be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes a network-reachable, low-complexity, sandbox-escaping RCE requiring only that a user open a page, which on its face is critical; however, Chromium's engineering triage rated the bug Low severity, and CISA's SSVC framework records Exploitation: none and Automatable: no (with Technical Impact: total), all of which argue against imminent mass exploitation. There is no KEV listing and no POC in the provided data, so this is best read as a high-technical-impact but hard-to-weaponize memory bug rather than an actively exploited threat - even a mid-sized municipal IT team in olsztyn should still patch promptly given the sandbox-escape potential, but this does not warrant emergency out-of-band response. The AC:L in the input also sits uneasily with a use-after-free requiring a heap grooming race, so a realistic attack complexity is likely higher than the vector states - verify with the vendor advisory.

An attacker hosts a crafted HTML page and lures a Chrome-for-iOS user (via phishing link, malvertising, or a compromised site) into opening it; the page drives the Sync code path to free and then reuse a heap object, and with successful heap grooming the attacker corrupts memory to gain code execution outside the browser sandbox. No POC is present in the provided data, and the low-complexity claim in the CVSS vector is optimistic for a use-after-free that in practice requires a reliable heap race.