CVE-2026-13777: Google Chrome iOS RCE Vulnerability

CVE-2026-13777 Overview

CVE-2026-13777 is an input validation flaw in the iOSWeb component of Google Chrome on iOS. Versions prior to 150.0.7871.47 fail to properly validate untrusted input, enabling a remote attacker to trigger heap corruption through a crafted HTML page. Chromium classifies the security severity as Critical. Exploitation requires user interaction, such as visiting an attacker-controlled webpage. The Common Weakness Enumeration classification is [CWE-20] Improper Input Validation. Successful exploitation can result in memory corruption within the browser process, leading to arbitrary code execution in the renderer context.

Critical Impact
A remote attacker who convinces a user to load a crafted HTML page can corrupt heap memory in Google Chrome on iOS, potentially achieving code execution within the browser process.

Affected Products

Google Chrome on iOS versions prior to 150.0.7871.47
Apple macOS (Chrome desktop stable channel)
Microsoft Windows and Linux (Chrome desktop stable channel)

Discovery Timeline

2026-06-30 - CVE-2026-13777 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13777

Vulnerability Analysis

The vulnerability resides in the iOSWeb component that handles web content rendering in Google Chrome on iOS. Insufficient validation of untrusted input allows attacker-controlled data from a crafted HTML page to reach code paths that assume well-formed input. When the untrusted input reaches memory management routines, the resulting state inconsistency corrupts heap metadata or adjacent heap allocations.

Heap corruption in a browser process typically enables attackers to overwrite function pointers, virtual table entries, or object headers. This provides a primitive for controlling execution flow. Because Chrome on iOS relies on the system WKWebView framework, the exploitation surface is constrained but still valuable for adversaries pursuing initial access or credential theft.

Exploitation requires user interaction — the victim must load a malicious page. The attack vector is network-based, with no privileges required. Impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is improper validation of untrusted input reaching the iOSWeb rendering path [CWE-20]. Input parsing routines fail to enforce boundary or type constraints before the data influences heap allocations or object dispatch. Google's advisory does not disclose the exact sink function pending broad patch adoption.

Attack Vector

An attacker hosts a crafted HTML page and lures a target to visit it through phishing, malvertising, or a compromised website. When Chrome on iOS parses the page, the malformed content triggers heap corruption inside the browser process. Technical details are tracked in the Chromium Issue Tracker Entry and the Google Chrome Stable Update.

Detection Methods for CVE-2026-13777

Indicators of Compromise

Chrome for iOS process crashes, hangs, or unexpected restarts immediately following navigation to an untrusted URL
Outbound connections from mobile endpoints to newly registered or low-reputation domains hosting HTML payloads
Chrome version strings on iOS reporting builds earlier than 150.0.7871.47 in device inventory data

Detection Strategies

Inventory Chrome iOS versions across managed mobile devices and flag any instance below 150.0.7871.47
Correlate mobile web proxy logs with threat intelligence feeds to identify visits to malicious HTML delivery domains
Hunt for anomalous crash telemetry from mobile device management (MDM) reporting associated with Chrome sessions

Monitoring Recommendations

Ingest MDM and mobile threat defense telemetry into a central analytics platform for version drift and crash pattern review
Monitor web gateway logs for URL patterns and referrers linked to Chrome renderer exploitation campaigns
Track EPSS trend data — currently 0.293% at the 21.035 percentile — for shifts indicating active exploitation attempts

How to Mitigate CVE-2026-13777

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store
Enforce automatic app updates on managed iOS devices via MDM configuration profiles
Notify users to avoid untrusted links until patch deployment is confirmed across the fleet

Patch Information

Google addressed the vulnerability in Chrome for iOS 150.0.7871.47. Deployment details and release notes are available in the Google Chrome Stable Update advisory. Administrators managing enterprise fleets should validate app version compliance after users update.

Workarounds

Restrict access to untrusted websites through mobile web filtering policies until all devices are patched
Direct users to alternative browsers based on the iOS WKWebView stack for high-risk browsing tasks until update completes
Enable phishing protection and safe browsing features on mobile endpoints to block known malicious HTML delivery infrastructure

bash

# Verify Chrome for iOS version compliance via MDM query
# Example: Microsoft Intune managed app configuration check
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString
# Expected minimum value: 150.0.7871.47