Description

Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:49.270Z",
  "pubdate": "2026-08-25T21:17:49.270Z",
  "executiveSummary": "A critical security vulnerability exists in Google Chrome on iOS due to the use of an uninitialized variable. This flaw permits a remote attacker to potentially achieve arbitrary code execution outside the application's security sandbox.\nThe vulnerability resides within the Chromium engine, which underpins the browser's functionality on the iOS platform. Successful exploitation allows for the execution of malicious code, bypassing the browser's isolation mechanisms.\nThis issue is classified as critical, as it allows for severe compromise of the host device by a remote attacker through the delivery of a crafted HTML page.\nExploitation requires no interaction from the user beyond visiting a malicious webpage, making it an attractive vector for drive-by attacks.\nUsers of affected versions prior to 152.0.7977.65 are at high risk and are advised to update their browser immediately to neutralize this threat.",
  "technicalDetails": "The vulnerability stems from the use of an uninitialized variable within the Chromium engine utilized by Google Chrome on iOS. In memory-unsafe environments or specific logic flows, the failure to initialize variables can lead to the retention of stale data within a memory allocation. If this uninitialized memory is subsequently read or used in control flow decisions, it provides an attacker with a mechanism to influence program state with unpredictable, attacker-controlled, or attacker-influenced data.\nThe attack flow begins when an attacker directs a target to a crafted HTML page hosted on a remote server. When the browser parses this page, the flawed logic component is triggered. The uninitialized variable is accessed during the execution of browser-side routines, potentially leading to memory corruption, type confusion, or invalid pointer dereferencing.\nBy carefully crafting the heap layout or influencing the environment prior to the triggering of the uninitialized variable access, an attacker can coerce the browser into using the stale memory as a pointer or a critical control-flow variable. This primitive allows the attacker to redirect the instruction pointer to arbitrary code sequences or gadget chains, such as those used in Return-Oriented Programming (ROP) or Jump-Oriented Programming (JOP).\nBecause the vulnerability occurs within the browser environment, which usually operates within a constrained sandbox, the capacity to execute code outside this sandbox indicates a significant breakdown in the browser's security boundary. This suggests the exploit may leverage additional vulnerabilities or design weaknesses to escape the iOS application container, leading to full remote code execution (RCE) on the device.\nThis vulnerability affects versions of Google Chrome on iOS prior to 152.0.7977.65. The exploitation is entirely remote and does not require local authentication or elevated privileges prior to the initial engagement. The payload, delivered through the HTML document via malicious JavaScript or rendering instructions, interacts directly with the browser's engine component. Post-exploitation, an attacker could potentially gain unauthorized access to sensitive user data, track browser activity, or establish persistence on the device by escalating their privileges beyond the browser's sandbox limitations."
}