This vulnerability involves a use-after-free condition in the WebMIDI implementation of Google Chrome on iOS. An attacker can exploit this by delivering a specially crafted HTML page that triggers the use-after-free, potentially leading to sandbox escape. The issue affects Chrome versions before 149.0.7827.53 on iOS. The vulnerability is tracked as CWE-416 (Use After Free). Although the CVSS score is 9.6 (critical), no official remediation level or patch details are explicitly stated in the provided data. The vendor advisory link references a stable channel update but does not confirm patch availability for this specific issue.

Successful exploitation could allow a remote attacker to escape the Chrome sandbox on iOS, potentially leading to full compromise of the browser environment including confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should avoid visiting untrusted or suspicious websites and keep Chrome updated to the latest available version.