The vulnerability is a use‑after‑free error that can corrupt the heap in Chrome for iOS. When a user visits a specially crafted HTML page and performs certain UI gestures, the browser may read freed memory and overwrite valuable data structures. Although the official description states only that the corruption could *potentially* lead to exploitation, the high CVSS score of 8.8 signals a serious risk of compromise or denial of service if an attacker can leverage the heap corruption for further attacks such as arbitrary code execution or memory disclosure.

Google Chrome for iOS versions earlier than 150.0.7871.47 are affected. All devices running those releases are susceptible to the use‑after‑free flaw when a malicious web page incurs user interaction. The issue does not affect other platforms or browser channels.

The low EPSS score of < 1% indicates that exploit attempts are currently rare, but the vulnerability remains high severity, with a CVSS score of 8.8, due to the remote nature of the trigger. An attacker must persuade a user to open the crafted page and perform the required gestures, making social engineering a key component of the attack. The flaw is not listed in CISA’s KEV catalog, meaning there is no confirmed exploitation at the time of this analysis, yet the potential for a local heap corruption, combined with the immediate action.