This vulnerability involves a use-after-free condition in the iOS version of Google Chrome before 147.0.7727.138. An attacker can exploit this by delivering a specially crafted HTML page that triggers heap corruption. The CVSS vector indicates the attack requires no privileges but does require user interaction and can result in high impact on confidentiality, integrity, and availability. The issue is classified as critical by Chromium security but is reported here with a high severity rating.

Successful exploitation could lead to remote code execution or other severe consequences due to heap corruption, affecting the confidentiality, integrity, and availability of the affected system. Since it requires user interaction, exploitation depends on the victim visiting a maliciously crafted webpage. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Users should update to version 147.0.7727.138 or later once confirmed available. Until then, exercise caution when browsing untrusted websites on affected Chrome versions on iOS.