CVE-2026-10951 is a use-after-free vulnerability in the Autofill feature of Google Chrome on iOS. An attacker who convinces a user to engage in certain UI gestures on a maliciously crafted HTML page may trigger heap corruption, potentially leading to arbitrary code execution or other impacts. The vulnerability affects Chrome versions before 149.0.7827.53. There is no explicit vendor advisory stating the availability of a patch or remediation level, but the referenced Chrome stable channel update blog post should be consulted for current status.

Successful exploitation could lead to heap corruption with high impact on confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). This means an attacker could potentially execute arbitrary code or cause a denial of service on affected devices.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once confirmed patched. Until then, avoid interacting with untrusted web content that could trigger the vulnerability.