CVE-2026-10961

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted

Google ChromeApplications & CMS

CVSS

8.3High

ExploitationExploitation reported1 outlet report it, first 26 Oct 2026. Not yet in the KEV catalogReports

Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 26 Oct 2026FIRST EPSS

Fixed in149.0.7827.53Fixed versionCVE List

Published4 Jun 2026Updated 5 Jun 2026CVE List

What fixes it

149.0.7827.53ChromeCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

4 Jun 2026, 23:03 UTCPublishedCVE List
26 Oct 2026, 15:42 UTCFirst reported exploitedBluesky: exploited in the wild
NowNot on CISA's known exploited list yet

Reports 1

One outlet reports exploitation. Reports are not confirmation; each links to its source.

@cybersecurity.page: PHP2Shell is now confirmed exploited in the wild: honeypot evidence shows memory disclosure leading to remote code execution on Apache running PHP 8.4.26. The flaws, CVE-2026-10961Bluesky: exploited in the wild, 26 Oct 2026Exploitation reported

Description

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Text from CVE List

Affected versions 1

Chromeaffected: 149.0.7827.53 before 149.0.7827.53CVE List