CVE-2026-78935

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Analysis

AI-generated

Technical impact

The vulnerability is a use‑of‑uninitialized‑variable flaw in the Mobile component of Google Chrome on iOS, affecting releases older than 152.0.7977.65. A crafted HTML page can cause the variable to contain unpredictable data, potentially allowing an attacker to execute arbitrary code outside the Chrome sandbox. The flaw falls under CWE‑457 and is rated as critical by Chromium security teams.

Affected Systems

Affected systems are devices running Google Chrome for iOS prior to version 152.0.7977.65.

Risk and Exploitability

Exploitability is high because it requires only a remote attacker to load a malicious web page, which is a typical browsing scenario. The EPSS score is <1%, and the CVSS score of 9.6 indicates a severe risk. The vulnerability is not listed in the CISA KEV catalog, yet the potential for arbitrary code execution warrants immediate remediation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome 152.0.7977.65 or later on all iOS devices
  • If an update is not yet available, temporarily disable Chrome or restrict access to untrusted web content
  • Monitor Google Chrome release notes for additional patches and apply them promptly

Generated by OpenCVE AI on August 26, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Title Use of Uninitialized Variable in Chrome Mobile iOS Allows Potential Remote Code Execution
Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Use of Uninitialized Variable in Chrome Mobile iOS Allows Potential Remote Code Execution
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-457
References
Earlier changes (1)
Weaknesses
  • CWE-457

    Use of Uninitialized Variable

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:57 AM
Reserved
Aug 25, 2026, 6:04 AM

View source JSON

Updated
Aug 26, 2026, 3:19 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:17 PM
Modified
Aug 27, 2026, 4:16 AM

View source JSON

No data.

Updated
Aug 26, 2026, 8:45 PM

JSON