CVE-2026-11165
A use‑after‑free bug in Chrome’s WebMIDI implementation on iOS could let a malicious web page escape the browser sandbox. The flaw exists in Chrome versions before 149.0.7827.53. Updating to a newer version removes the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome on iOS (Apple iPhone OS) versions prior to 149.0.7827.53.
Real-world impact
An attacker could run code outside the browser sandbox, potentially accessing device files or other apps on the iPhone.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is exploitable over the network, requires no user interaction beyond visiting a crafted page, and can lead to complete compromise of the device.
What to do about it
- 01Upgrade Google Chrome on iOS to version 149.0.7827.53 or later.
- 02Restart the browser.
NVD description indicates fix in Chrome 149.0.7827.53 or later.
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…vendor advisory
- issues.chromium.org/issues/502099949permissions required