CVE-2026-18011: Chrome for iOS Information Disclosure Flaw

CVE-2026-18011 Overview

CVE-2026-18011 affects Google Chrome for iOS in versions prior to 151.0.7922.72. The vulnerability stems from an inappropriate implementation in Chrome for iOS that exposes potentially sensitive information from process memory. An attacker with physical access to the device can leverage the flaw to read data that should remain isolated in memory. Chromium classifies the security severity as Low.

The issue requires local, physical access rather than remote interaction, which limits the scope of exploitation. Google addressed the flaw in the Chrome stable channel update.

Critical Impact
A local attacker with physical access to an iOS device running a vulnerable Chrome build can obtain sensitive information from Chrome's process memory.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running the vulnerable Chrome build
Any user profile or browsing session held in Chrome process memory on affected devices

Discovery Timeline

2026-07-30 - CVE-2026-18011 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18011

Vulnerability Analysis

CVE-2026-18011 is an information disclosure issue in Chrome for iOS. The advisory describes it as an inappropriate implementation, meaning Chrome does not properly protect the contents of process memory under specific conditions reachable through local access. A local attacker who can interact with the device directly can retrieve data that resides in Chrome's memory space.

Information stored in browser process memory commonly includes rendered content, session state, cached credentials in transit, and fragments of visited pages. Because the vulnerability requires physical access, exploitation is constrained to scenarios such as unattended, lost, or stolen devices, or shared device environments.

The Chromium Issue Tracker Entry and the Google Chrome Stable Update document the fix without disclosing full exploitation details, consistent with Chromium's disclosure practices for issues rated Low severity.

Root Cause

The root cause is an inappropriate implementation in the Chrome for iOS codebase that allows sensitive data to remain accessible in process memory under conditions an attacker with physical access can reach. Chromium's advisory does not enumerate the specific component. The fix ships in Chrome for iOS 151.0.7922.72.

Attack Vector

The attack vector is local and requires physical access to the target iOS device. The attacker interacts directly with the device to trigger the information disclosure. No network access, user interaction beyond device access, or elevated privileges are described in the advisory.

No verified proof-of-concept code is available for CVE-2026-18011.
Refer to the Chromium Issue Tracker and Chrome release notes for
technical details as they are progressively disclosed.

Detection Methods for CVE-2026-18011

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-18011.
Physical access exploitation typically leaves no network-level artifacts, so detection relies on device management telemetry.
Chrome for iOS versions below 151.0.7922.72 on managed devices should be treated as vulnerable.

Detection Strategies

Inventory Chrome for iOS installations across the mobile fleet and flag any version below 151.0.7922.72.
Use Mobile Device Management (MDM) reporting to identify devices with outdated Chrome builds and prioritize their remediation.
Correlate lost or stolen device reports with the presence of vulnerable Chrome versions to prioritize investigation of potential physical-access exposure.

Monitoring Recommendations

Track Chrome for iOS version compliance continuously through MDM policy reporting.
Monitor for repeated physical unlock failures or device access anomalies on iOS endpoints handling sensitive corporate data.
Subscribe to the Chrome Releases blog to detect future Chrome for iOS advisories that may chain with local-access issues.

How to Mitigate CVE-2026-18011

Immediate Actions Required

Update Chrome for iOS to version 151.0.7922.72 or later on all managed and personal devices.
Enforce device passcodes, biometric unlock, and automatic screen lock to raise the barrier for physical access exploitation.
Enable iOS remote wipe and Find My iPhone on corporate devices to limit exposure of lost or stolen devices.

Patch Information

Google addressed CVE-2026-18011 in Chrome for iOS 151.0.7922.72. Users should install the update through the Apple App Store. See the Google Chrome Stable Update announcement and the Chromium Issue Tracker Entry for release information.

Workarounds

Restrict physical access to devices that store sensitive browsing sessions until Chrome for iOS is updated.
Sign out of sensitive web applications and clear Chrome browsing data before leaving devices unattended.
Consider using an alternative browser on unpatched devices only when it is centrally managed and known to be free of comparable local-access issues.

bash

# Example MDM query to identify non-compliant Chrome for iOS installs
# (pseudocode for MDM console reporting)
SELECT device_id, user, app_version
FROM installed_apps
WHERE app_bundle_id = 'com.google.chrome.ios'
  AND app_version < '151.0.7922.72';