CVE-2026-78957: Chrome iOS Information Disclosure Flaw

CVE-2026-78957 Overview

CVE-2026-78957 is an information disclosure vulnerability in the Mobile component of Google Chrome on iOS. Versions prior to 152.0.7977.65 allow a local attacker to obtain sensitive information through a crafted file. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium rates the security severity as Low, while NVD assigns a medium CVSS score.

Exploitation requires local access and user interaction, limiting practical attack scenarios. However, successful exploitation can expose sensitive browser data on affected iOS devices.

Critical Impact
A local attacker can retrieve sensitive information from Google Chrome on iOS by delivering a crafted file that the user opens.

Affected Products

Google Chrome for iOS versions prior to 152.0.7977.65
iOS mobile browser component (Chrome Mobile)
Chromium-based iOS builds sharing the vulnerable Mobile component

Discovery Timeline

2026-08-25 - CVE-2026-78957 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78957

Vulnerability Analysis

The vulnerability resides in the Mobile component of Google Chrome for iOS. A crafted file, when processed by the browser, causes Chrome to expose sensitive information to a local attacker. The issue maps to [CWE-200], which covers unintended exposure of data to actors without authorization.

Because the attack vector is local and requires user interaction, the attacker must convince the victim to open or interact with a maliciously prepared file on the device. Once processed, Chrome leaks data that the attacker can subsequently retrieve or observe. The confidentiality impact is high, while integrity and availability remain unaffected. EPSS data indicates a low probability of exploitation activity at publication.

Root Cause

The root cause is improper handling of file content within Chrome's iOS Mobile component. Chrome fails to enforce sufficient boundaries between file-derived data and information that should remain isolated from unprivileged local contexts. Google has not released public technical details beyond the advisory. See the Chromium Issue Tracker #533123348 for the tracking record.

Attack Vector

An attacker with local access to the iOS device delivers a crafted file to the victim. The victim opens or renders the file in Chrome, which triggers the information leak. The attacker then reads the disclosed data through their local vantage point. Refer to the Google Chrome Stable Update advisory for release notes.

No public proof-of-concept code is available. The vulnerability is described in prose only, consistent with Google's staged disclosure practices for Chromium issues.

Detection Methods for CVE-2026-78957

Indicators of Compromise

Presence of Google Chrome for iOS builds earlier than 152.0.7977.65 on managed devices
Unexpected file downloads or attachments processed by Chrome on iOS shortly before anomalous data access events
Mobile device management (MDM) inventory entries showing outdated Chrome iOS versions

Detection Strategies

Query MDM and endpoint inventory sources for Chrome iOS version strings and flag any below 152.0.7977.65
Correlate file-handling events in Chrome on iOS with subsequent access to sensitive application data
Review browser telemetry for crafted file types delivered through messaging, email, or AirDrop channels

Monitoring Recommendations

Continuously monitor Chrome version distribution across the iOS fleet through MDM reporting
Track file-open events originating from untrusted sources on mobile endpoints
Alert on Chrome iOS installations that fail to update within your defined patch window

How to Mitigate CVE-2026-78957

Immediate Actions Required

Update Google Chrome on iOS to version 152.0.7977.65 or later through the App Store
Enforce automatic app updates on managed iOS devices via MDM policy
Instruct users to avoid opening untrusted files in Chrome on iOS until patching completes

Patch Information

Google released the fix in Chrome for iOS version 152.0.7977.65. Details are available in the Google Chrome Stable Update announcement. The corresponding tracker entry is Chromium Issue #533123348.

Workarounds

Restrict opening files from untrusted sources in Chrome on iOS until the update is applied
Use an alternative, fully patched browser for handling sensitive files during the remediation window
Apply MDM restrictions that limit file sharing from untrusted apps into Chrome

bash

# Verify Chrome iOS version via MDM inventory query
# Example: filter devices running Chrome < 152.0.7977.65
mdm-cli query --app "com.google.chrome.ios" --version-lt "152.0.7977.65"