Description

Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:17:59.580Z",
  "pubdate": "2026-08-25T21:17:59.580Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) memory corruption flaw identified in Google Chrome for iOS prior to version 152.0.7977.65.\nA remote attacker can leverage this flaw to execute arbitrary code outside the application sandbox by delivering crafted network traffic.\nThe vulnerability represents a high-severity security risk as it allows for potential system-level compromise or sandbox escape, undermining the security architecture of the iOS platform.\nSuccessful exploitation requires the victim to process malicious network content, typically through interaction with a compromised website or intercepted traffic.\nGiven the nature of UAF vulnerabilities, the exploit likely involves manipulating heap memory structures to achieve arbitrary code execution via dangling pointer references.\nImmediate application of the vendor-supplied patch is required to remediate this exposure, as there are no viable workarounds for this memory management failure.",
  "technicalDetails": "The vulnerability originates from a memory management error known as Use-After-Free (UAF), which occurs within the Google Chrome Mobile implementation on the iOS platform. The flaw manifests when the application incorrectly manages the lifecycle of an object in memory, leaving a dangling pointer that continues to reference the memory address after the object has been deallocated.\nThe root cause is rooted in improper handling of object references during complex asynchronous network operations or component state transitions. When the application frees a heap-allocated object but fails to clear associated pointers, a subsequent access to that memory address can be manipulated by an attacker.\nAn attacker triggers this vulnerability by providing maliciously crafted network traffic designed to induce a specific state in the browser's networking stack or rendering engine. By carefully timing the request, the attacker can force the application to perform a free operation on a target object. Through heap grooming or heap spraying techniques, the attacker then allocates a new, malicious object at the same memory location previously occupied by the original object.\nWhen the browser attempts to access the memory via the original dangling pointer, it inadvertently interacts with the attacker's controlled data. If this data contains function pointers or objects with virtual method tables, the attacker can redirect the program's control flow to arbitrary code, effectively hijacking the execution process.\nBecause the exploit executes within the context of the mobile application's network processing flow, the attacker may bypass the standard application sandbox. On iOS, achieving code execution outside the sandbox implies the ability to execute arbitrary instructions with the privileges granted to the browser process. In scenarios where the browser process lacks sufficient restrictions, or if the exploit is chained with additional kernel-level vulnerabilities, this can lead to full device compromise.\nThis vulnerability affects Google Chrome for iOS versions earlier than 152.0.7977.65. There are no authentication requirements for an attacker to initiate this attack, as it is triggered remotely via standard network-based interaction. The attack flow relies entirely on the successful exploitation of the application's memory management logic during the parsing of network responses, making it a critical threat to users navigating untrusted or compromised web content."
}