CVE-2026-17967: Chrome for iOS Use After Free Vulnerability

CVE-2026-17967 Overview

CVE-2026-17967 is a use-after-free vulnerability in Chrome for iOS affecting Google Chrome on iOS releases prior to 151.0.7922.72. A remote attacker can potentially exploit heap corruption by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Low, but the underlying memory safety flaw [CWE-416] warrants prompt patching due to the browser's role as an internet-facing attack surface.

Critical Impact
A remote attacker who convinces a user to visit a malicious HTML page can trigger heap corruption in Chrome for iOS, potentially enabling further exploitation within the browser process.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Applications embedding vulnerable Chrome for iOS components

Discovery Timeline

2026-07-30 - CVE-2026-17967 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17967

Vulnerability Analysis

The issue is a use-after-free condition [CWE-416] in Chrome for iOS. Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed. An attacker who controls page content can influence allocation and deallocation patterns to reclaim the freed region with attacker-controlled data.

When the dangling pointer is dereferenced, the browser operates on attacker-influenced memory. This produces heap corruption that can lead to arbitrary read/write primitives inside the renderer process. Chromium rated the severity as Low, which typically indicates constrained exploitation preconditions or limited impact scope.

Root Cause

The root cause is object lifetime mismanagement in a Chrome for iOS component. An object is deallocated while another code path still holds a reference to it. Subsequent access to that reference results in a use-after-free.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome for iOS build. The page triggers the object lifecycle sequence needed to free and reuse the target allocation. No prior authentication is required, but user interaction (navigation to the malicious page) is necessary.

No public proof-of-concept code is available for this vulnerability. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-17967

Indicators of Compromise

Chrome for iOS crash reports referencing heap corruption or memory access violations following navigation to untrusted content
Outbound connections from iOS devices to newly registered or low-reputation domains hosting HTML payloads
Anomalous renderer process termination patterns on managed iOS fleets

Detection Strategies

Inventory installed Chrome for iOS versions across managed devices and flag builds below 151.0.7922.72
Monitor mobile device management (MDM) telemetry for Chrome app version compliance
Correlate web proxy logs with threat intelligence feeds to identify user visits to malicious HTML delivery infrastructure

Monitoring Recommendations

Enforce browser version reporting through MDM and generate alerts for out-of-date Chrome for iOS installs
Track crash telemetry from iOS endpoints for signs of exploitation attempts
Review DNS and TLS SNI logs for connections to suspicious domains delivering exploit content

How to Mitigate CVE-2026-17967

Immediate Actions Required

Update Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push updated Chrome builds to managed iOS devices via MDM policy
Communicate the update requirement to end users who install Chrome outside managed channels

Patch Information

Google released a fixed build of Chrome for iOS at version 151.0.7922.72. Details are documented in the Google Chrome Update Announcement and tracked in the Chromium Issue Tracker Entry. Apply the update through the App Store or an enterprise mobile application management workflow.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is deployed
Direct users to an alternative patched browser on iOS if the update cannot be applied immediately
Apply web content filtering to block access to untrusted HTML content on managed mobile devices

bash

# Verify Chrome for iOS version via MDM inventory query
# Example: Jamf Pro advanced search criteria
# Application Title: Chrome
# Application Version: less than 151.0.7922.72