Description
Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Published: 2026-08-25
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Update
AI Analysis

Impact

This vulnerability is a use‑after‑free flaw in the Mobile version of Google Chrome for iOS. The defect permits a remote attacker, by sending specially crafted network traffic, to execute arbitrary code outside the browser sandbox. The impact is compromise of the device’s integrity and potential leakage of user data. It is classified as a high‑severity issue due to the breadth of damage the attacker can cause.

Affected Systems

The affected product is Google Chrome on iOS, specifically versions prior to 152.0.7977.65. Users running these versions are vulnerable to remote code execution when parsing network requests.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1 and an EPSS score of <1%, and it is not listed in the CISA KEV catalog. It can be exploited remotely over the network by sending crafted traffic that triggers the freed memory usage, causing arbitrary code to execute with Chrome privileges and potentially escape the sandbox. Despite the low EPSS score, the potential damage warrants precaution.

Generated by OpenCVE AI on August 26, 2026 at 21:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Google Chrome update (152.0.7977.65 or later) to remove the use‑after‑free flaw.
  • If an immediate update is not possible, run Chrome within a tightly controlled sandbox or restrict its network access to known, trusted domains.
  • Continuously monitor device logs for abnormal crashes or unexpected executable activity that may indicate exploitation attempts.

Generated by OpenCVE AI on August 26, 2026 at 21:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in iOS Chrome Allows Remote Code Execution

Wed, 26 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 26 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in iOS Chrome Allows Remote Code Execution

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:57:46.783Z

Reserved: 2026-08-25T06:08:06.191Z

Link: CVE-2026-79039

cve-icon Vulnrichment

Updated: 2026-08-26T16:08:25.545Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:17:59.580

Modified: 2026-08-27T04:17:13.013

Link: CVE-2026-79039

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T21:45:03Z

Weaknesses