This vulnerability is a use-after-free bug in Google Chrome for iOS before version 149.0.7827.53. It enables remote code execution through a crafted HTML page, posing a critical security risk. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with no confirmed exploits in the wild. The vendor advisory linked does not explicitly state if the issue is fixed in the referenced update or later versions, so patch status is not confirmed.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected device, compromising confidentiality, integrity, and availability of the system. This could lead to full compromise of the Chrome browser on iOS. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should ensure they update to the latest Chrome version for iOS once the fix is confirmed available. Until then, avoid visiting untrusted or suspicious websites that could host crafted HTML content.