CVE-2026-79039: Google Chrome iOS Use After Free Vulnerability

CVE-2026-79039 Overview

CVE-2026-79039 is a use-after-free vulnerability [CWE-416] in the Mobile component of Google Chrome on iOS. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the issue via crafted network traffic to execute arbitrary code outside the browser sandbox. Google's Chromium security team rated the underlying issue as High severity. The vulnerability is tracked in the Chromium issue tracker as issue #517548647 and was addressed in the Stable channel update announced by Google.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox on affected iOS devices, giving attackers a foothold beyond the browser's isolation boundary.

Affected Products

Google Chrome for iOS versions prior to 152.0.7977.65
Apple iPhone OS devices running vulnerable Chrome builds
Mobile component of the Chromium rendering stack on iOS

Discovery Timeline

2026-08-25 - CVE-2026-79039 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79039

Vulnerability Analysis

The vulnerability resides in the Mobile component of Google Chrome on iOS. It is classified as a use-after-free condition, where memory is referenced after it has been released back to the allocator. An attacker who can deliver crafted network traffic to the browser can trigger the freed-then-reused object path and coerce the process into executing attacker-controlled code. Because the outcome escapes the sandbox, the compromise reaches beyond the renderer's confinement on iOS. The high attack complexity indicates that reliable exploitation requires precise conditions around memory layout and object lifetime.

Root Cause

The root cause is improper management of an object's lifecycle within Chrome's Mobile networking path. A pointer to a freed object is retained and later dereferenced, allowing an attacker to place controlled data at the reclaimed allocation. This is a canonical instance of [CWE-416] use after free.

Attack Vector

Exploitation occurs remotely over the network with no authentication and no user interaction beyond normal browsing. The attacker delivers crafted network traffic that reaches the vulnerable Mobile component. See the Chromium Issue Tracker #517548647 and the Google Chrome Stable Update for background. No public proof-of-concept is available at this time.

Detection Methods for CVE-2026-79039

Indicators of Compromise

Chrome for iOS processes exhibiting unexpected crashes or renderer terminations tied to network events
Outbound connections from iOS Chrome to previously unseen or low-reputation domains preceding process anomalies
Anomalous child process activity or unusual memory growth in the Chrome application on managed iOS devices

Detection Strategies

Inventory Chrome for iOS versions across managed devices and flag any build below 152.0.7977.65
Correlate mobile telemetry from MDM with browser crash reports to identify potential exploitation attempts
Monitor network egress from iOS endpoints for connections to domains associated with known browser exploit delivery infrastructure

Monitoring Recommendations

Enable centralized crash and telemetry collection from Chrome on iOS through MDM integration
Track DNS and TLS SNI logs for iOS user agents visiting uncategorized or newly registered domains
Alert on repeated Chrome application relaunches on the same device within short intervals

How to Mitigate CVE-2026-79039

Immediate Actions Required

Update Google Chrome on iOS to version 152.0.7977.65 or later through the Apple App Store
Push forced application updates via Mobile Device Management for corporate-managed iOS fleets
Advise users to restart Chrome after updating to ensure the patched binary is loaded

Patch Information

Google addressed the issue in Chrome for iOS 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for the official release notes and to the Chromium Issue Tracker #517548647 for the associated bug entry.

Workarounds

Use an alternative browser on iOS until the Chrome update is applied across the fleet
Restrict access to untrusted sites through DNS filtering or secure web gateway policies
Enforce MDM policies that block installation of Chrome versions below 152.0.7977.65

bash

# Example MDM compliance check for Chrome on iOS version
# Pseudocode for an MDM policy rule
if app.bundle_id == "com.google.chrome.ios" \
   and app.version < "152.0.7977.65":
    device.mark_noncompliant(reason="CVE-2026-79039")
    device.enforce_update(app="com.google.chrome.ios")