This vulnerability is an uninitialized use issue in Google Chrome on iOS versions before 148.0.7778.216. Exploitation requires a remote attacker to lure a user into performing specific UI gestures on a maliciously crafted HTML page, resulting in arbitrary code execution inside the browser sandbox. The CVSS score is 7.5, indicating high severity with network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details.

Successful exploitation allows remote code execution within the sandboxed environment of Chrome on iOS, potentially compromising user data and browser integrity. The attack requires user interaction, which limits automatic exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official confirmation, users should update to version 148.0.7778.216 or later once available. Avoid interacting with untrusted web content that may attempt to trigger the vulnerability.