CVE-2026-9956: Use after free in Google Chrome
CVE-2026-9956 is a use-after-free vulnerability in Google Chrome on iOS versions prior to 148.0.7778.216. It allows a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at the time of this report. The vendor advisory linked does not explicitly confirm patch availability or remediation status.
AI Analysis
Technical Summary
This vulnerability involves a use-after-free condition in Google Chrome on iOS before version 148.0.7778.216. Exploitation requires user interaction through specific UI gestures on a maliciously crafted HTML page, potentially leading to arbitrary code execution. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation could allow a remote attacker to execute arbitrary code on the affected device, compromising confidentiality, integrity, and availability of the system. This could lead to full control over the affected Chrome browser instance on iOS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users and administrators should monitor for official updates and apply them promptly once available. Until a patch is confirmed, exercising caution with untrusted web content and avoiding unsolicited links requiring UI gestures is advisable.
CVE-2026-9956: Use after free in Google Chrome
Description
CVE-2026-9956 is a use-after-free vulnerability in Google Chrome on iOS versions prior to 148.0.7778.216. It allows a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at the time of this report. The vendor advisory linked does not explicitly confirm patch availability or remediation status.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a use-after-free condition in Google Chrome on iOS before version 148.0.7778.216. Exploitation requires user interaction through specific UI gestures on a maliciously crafted HTML page, potentially leading to arbitrary code execution. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation could allow a remote attacker to execute arbitrary code on the affected device, compromising confidentiality, integrity, and availability of the system. This could lead to full control over the affected Chrome browser instance on iOS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users and administrators should monitor for official updates and apply them promptly once available. Until a patch is confirmed, exercising caution with untrusted web content and avoiding unsolicited links requiring UI gestures is advisable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-05-28T17:24:59.749Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html","vendor":"Google"}]
Threat ID: 6a18c673e29bf47b503b6270
Added to database: 05/28/2026, 22:49:23 UTC
Last enriched: 06/05/2026, 21:15:09 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 102
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.