CVE-2026-78935: Google Chrome iOS RCE Vulnerability

CVE-2026-78935 Overview

CVE-2026-78935 is a critical vulnerability in Google Chrome on iOS caused by the use of an uninitialized variable in the Mobile component. Versions of Google Chrome on iOS prior to 152.0.7977.65 are affected. A remote attacker can leverage a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The flaw is classified under [CWE-457: Use of Uninitialized Variable] and requires user interaction, such as visiting an attacker-controlled webpage. Chromium security engineers rated the underlying issue as Critical.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox on iOS, resulting in a scope change and full compromise of confidentiality, integrity, and availability.

Affected Products

Google Chrome on iOS prior to 152.0.7977.65
Apple iPhone OS running vulnerable Chrome builds
Any iOS deployment where Chrome is installed as the browser

Discovery Timeline

2026-08-25 - CVE-2026-78935 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78935

Vulnerability Analysis

The vulnerability resides in the Mobile component of Google Chrome on iOS. Chrome reads memory that was never initialized before use, producing undefined behavior. An attacker who controls page content can influence what resides in that memory region. When Chrome consumes the stale or attacker-influenced bytes as pointers, indices, or control data, it can be steered into executing attacker-supplied code paths.

Because the flaw enables code execution outside the browser sandbox, exploitation grants access to resources normally isolated from web content. The CVSS scope change reflects that compromise crosses the sandbox trust boundary. Successful exploitation impacts confidentiality, integrity, and availability of the host application context on iOS.

Root Cause

The root cause is [CWE-457: Use of Uninitialized Variable]. A variable in the Mobile code path is read before it is assigned a defined value. On iOS, memory layout and allocator behavior can allow attacker-controlled HTML or JavaScript to shape the contents of the uninitialized region. The uninitialized value is then used in security-sensitive operations, breaking assumptions the surrounding code relies on.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in Chrome on iOS. No privileges are required, and the attack is delivered over the network. User interaction is required in the form of visiting the malicious page, which can be achieved through phishing, malicious advertising, or a compromised legitimate site. Once the page is rendered, the attacker triggers the uninitialized read to escape the sandbox and execute arbitrary code.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-78935 at the time of publication. The EPSS score is 0.509%. Technical details are tracked in the Chromium Issue Tracker #522082472.

Detection Methods for CVE-2026-78935

Indicators of Compromise

Chrome for iOS crash reports referencing the Mobile component or uninitialized memory access shortly after visiting an untrusted URL.
Outbound connections from iOS devices to newly registered or low-reputation domains immediately following browser rendering activity.
Anomalous post-browsing process behavior on managed iOS devices, such as unexpected background network callbacks.

Detection Strategies

Inventory Chrome for iOS versions across managed devices and flag any build earlier than 152.0.7977.65.
Correlate web proxy logs with threat intelligence feeds to identify user visits to domains hosting crafted HTML exploit content.
Monitor mobile device management (MDM) telemetry for repeated Chrome crashes on iOS that could indicate exploitation attempts.

Monitoring Recommendations

Enable centralized logging of browser version and update status from iOS endpoints through MDM.
Ingest web proxy and DNS telemetry into a SIEM to hunt for exploit delivery infrastructure targeting mobile users.
Track the Google Chrome Stable Update advisory for follow-on fixes and related identifiers.

How to Mitigate CVE-2026-78935

Immediate Actions Required

Update Google Chrome on iOS to version 152.0.7977.65 or later through the Apple App Store.
Enforce automatic app updates on managed iOS devices using MDM policy.
Communicate a user advisory warning against opening untrusted links in Chrome on iOS until patching is verified.

Patch Information

Google addressed CVE-2026-78935 in Chrome for iOS 152.0.7977.65. Refer to the Google Chrome Stable Update release notes and the Chromium Issue Tracker #522082472 for details. Verify the installed version through Chrome settings or MDM inventory reporting after applying the update.

Workarounds

Direct users to an alternative, fully patched browser on iOS until Chrome can be updated.
Block access to unknown or low-reputation domains at the network or secure web gateway layer for mobile devices.
Restrict Chrome for iOS through MDM app allowlists on high-risk devices until the fixed version is installed.

bash

# Verify Chrome for iOS version compliance via MDM inventory query
# Target: google.chrome app version >= 152.0.7977.65
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString