CVE-2026-78981: Google Chrome iOS Information Disclosure

CVE-2026-78981 Overview

CVE-2026-78981 is an information disclosure vulnerability in the Mobile component of Google Chrome on iOS. The flaw affects Chrome versions prior to 152.0.7977.65 and permits a local attacker to obtain sensitive information through a local program. Google's Chromium security team rated the underlying issue as Low severity, while the National Vulnerability Database (NVD) assigns a Medium CVSS rating. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A local attacker running a program on the same iOS device can extract sensitive information handled by Google Chrome, exposing browsing data, session artifacts, or other confidentiality-sensitive material.

Affected Products

Google Chrome for iOS prior to 152.0.7977.65
Apple iPhone OS (host platform for the affected Chrome build)
Chromium-based mobile builds sharing the affected component

Discovery Timeline

2026-08-25 - CVE-2026-78981 published to NVD
2026-08-27 - Last updated in NVD database
Chrome Stable Channel update published by Google addressing the issue (Chrome Releases)

Technical Details for CVE-2026-78981

Vulnerability Analysis

The vulnerability resides in the Mobile component of Google Chrome on iOS. It permits information leakage to a local program running on the same device. Under [CWE-200], the flaw exposes sensitive information to an actor not explicitly authorized to access it.

Because the exposure path is local, exploitation requires the attacker to already run code on the device, either through a companion app, a sideloaded process, or a compromised application context. Once positioned, the attacker retrieves data that Chrome intends to keep private to its own process boundary. The confidentiality impact is high while integrity and availability are unaffected, consistent with a pure disclosure primitive.

The issue is fixed in Chrome 152.0.7977.65 for iOS, delivered via the Chrome Stable Channel update.

Root Cause

The root cause is improper isolation or protection of sensitive data handled by Chrome's mobile code paths on iOS. Chrome exposes data to a lower-privileged local context without adequate access mediation. Google has not published detailed internals, and the Chromium tracker entry (Issue #533121405) remains access-controlled pending broader user patch adoption.

Attack Vector

Exploitation requires local access, user interaction, and a cooperating or malicious program on the iOS device. The attacker program interacts with Chrome data pathways to observe or retrieve information that should remain protected. No authentication is required beyond the ability to execute a local process, and no privilege escalation is needed to trigger the leak.

No public proof-of-concept, exploit module, or CISA KEV listing exists for this issue at the time of publication. See the vendor advisory for technical details as they are released.

Detection Methods for CVE-2026-78981

Indicators of Compromise

Presence of Google Chrome for iOS builds earlier than 152.0.7977.65 on managed devices
Local iOS applications requesting inter-process access to Chrome data containers or shared storage
Anomalous file access or URL scheme invocations targeting Chrome on iOS

Detection Strategies

Inventory managed iOS fleets through Mobile Device Management (MDM) and flag Chrome versions below 152.0.7977.65.
Review app-to-app interaction telemetry for unexpected calls into Chrome from unrelated third-party apps.
Correlate iOS application install events with subsequent sensitive-data access patterns from browser-adjacent processes.

Monitoring Recommendations

Track Chrome for iOS version distribution and enforce a minimum version policy through MDM compliance rules.
Monitor iOS app sideloading and enterprise-signed application deployments on corporate devices.
Alert on installation of unknown or untrusted apps on devices where users authenticate to sensitive corporate services through Chrome.

How to Mitigate CVE-2026-78981

Immediate Actions Required

Update Google Chrome on iOS to version 152.0.7977.65 or later through the Apple App Store.
Push the updated Chrome build to managed devices using MDM app deployment policies.
Restrict installation of unverified third-party or sideloaded iOS applications on devices that access corporate resources.
Educate users to avoid installing unknown apps that request broad device access.

Patch Information

Google has released the fixed version 152.0.7977.65 of Chrome for iOS. Details are available in the Chrome Stable Channel Update announcement. The corresponding Chromium tracker entry is Issue #533121405.

Workarounds

Where patching cannot be performed immediately, limit use of Chrome on iOS for sensitive browsing until the update is applied.
Enforce MDM configuration profiles that restrict installation of unmanaged applications on high-risk devices.
Rotate credentials or session tokens that may have been exposed through Chrome on iOS if suspicious local applications were observed.

bash

# Verify installed Chrome for iOS build via MDM query (conceptual)
# Example: query app inventory for CFBundleShortVersionString of com.google.chrome.ios
# and flag versions less than 152.0.7977.65
mdm query --app-bundle-id com.google.chrome.ios --field CFBundleShortVersionString