CVE-2026-7897Disclosure(apple / chrome)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apple chrome systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

apple CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html

Other references

https://issues.chromium.org/issues/504069514

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome
iphone_os

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 3d ago at 3 mentions (2026-05-07); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

apple google

Products

chromeiphone_os

1 version affected across 2 products

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

Disclosure

466.7%

Patch

233.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	3	Disclosure3
2026-05-14	1	Patch1
2026-05-15	1	Patch1
2026-06-08	1	Disclosure1

Full discourse6 posts

White Rabbitx 🏴‍☠️@TheRabbitPy146d
Patch
🚨 Chrome 148 emergency patch: 3 critical + dozens high-risk memory bugs ... update now. CVE highlights: CVE-2026-7896 (integer overflow in Blink → heap corruption/RCE potential), CVE-2026-7897 (use‑after‑free in Mobile → UAF → sandbox bypass), CVE-2026-7898 (use‑after‑free in Chromoting → remote desktop component RCE/escape); many other high/medium issues affect V8, ANGLE, GPU, Downloads, Tab Groups, Fonts, Skia, WebRTC and more. Hashtags: #Chrome148 #ZeroDay #PatchNow #InfoSec #BrowserSecurity
Post summary
Google’s Chrome 148 emergency patch addresses three critical memory bugs (integer overflow and use‑after‑free vulnerabilities) across multiple components, urging users to update immediately.
1004192
1.8K followersView on X
Lyrie.ai@lyrie_ai122d
Disclosure
CVE-2026-7897 – Use-after-free in Mobile component Severity: Critical Discovered: April 18 (Google internal) Impact: Arbitrary code execution in browser process Attack vector: Malicious web page with specific Mobile component usage
Post summary
CVE‑2026‑7897 is a critical use‑after‑free vulnerability in Google's Mobile component that permits arbitrary code execution via a malicious web page, as recently disclosed by Google internal discovery.
1000045
258 followersView on X
iototsecnews@iototsecnews148d
Patch
Google Chrome 148 がリリース：3件の Critical を含む 127 件の脆弱性を修正 https://iototsecnews.jp/2026/05/07/google-chrome-148-released-with-fix-for-127-security-vulnerabilities-update-now/ 今回のアップデートでは、メモリの管理不備が引き起こす、多くの脆弱性が修正されています。脆弱性 CVE-2026-7897／ CVE-2026-7898／CVE-2026-7901 などに見られる解放後メモリ使用の問題は、一度解放されたはずのメモリ領域に、プログラムが再アクセスすることで発生します。また、 CVE-2026-7896 のような整数オーバーフローや、 CVE-2026-7899 などの境界外読み取り／書き込みといった問題は、データのサイズ確認やアクセス範囲の制限が不十分なことで発生します。 V8 エンジンや ANGLE といった複雑な仕組みの中で、オブジェクトの寿命やデータの境界を正確に制御することの難しさが、これらの脆弱性につながっています。ご利用のチームは、ご注意ください。 #Chrome #Google #Vulnerability
Post summary
Google Chrome 148 has been released, fixing 127 vulnerabilities (including three critical ones) such as after‑free memory use, integer overflows, and out‑of‑bounds reads/writes. The update delivers the necessary patch to address these issues.
01000146
491 followersView on X
Infoflowcloud@infoflowcloud154d
Disclosure
🚨*CVE* CVE-2026-7897 Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbi… https://www.cve.org/CVERecord?id=CVE-2026-7897 ----- Traducción: CVE-2026-7897 Use… http://infoflow.cloud`
Post summary
CVE-2026-7897 is a use-after-free vulnerability in Chrome for iOS that could allow a remote attacker to execute code through specific user gestures; the announcement provides the vulnerability details but no PoC, exploit, patch, or active exploitation notes.
0000059
75 followersView on X
CVE@CVEnew154d
Disclosure
CVE-2026-7897 Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbi… https://www.cve.org/CVERecord?id=CVE-2026-7897
Post summary
The text announces the discovery of CVE‑2026‑7897, a use‑after‑free vulnerability in iOS Chrome, without providing PoC, exploit code, or patch details.
00000156
57.4K followersView on X
Geek@geek_of_life154d
Disclosure
Google corrige 127 vulnérabilités, mais 3 critiques. CVE-2026-7898 – Use-after-free in Chromoting (Chrome Remote Desktop) CVE-2026-7897 – Use-after-free in Mobile CVE-2026-7896 – Integer overflow in Blink (moteur de rendu) Le principal serait des bugs mineurs. #cyber #bug
Post summary
Google announced fixing 127 vulnerabilities, including three notable CVEs (CVE‑2026‑7898, CVE‑2026‑7897, CVE‑2026‑7896) involving use‑after‑free and integer overflow issues; the text notes the concerns are minor and provides no PoC or active exploitation evidence.
00000107
113 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	iphone_os	-	-	-
App	google	chrome	-	-	-

Explore more

Back to dashboard apple CVEs google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-7897

White Rabbitx 🏴‍☠️[verified]@TheRabbitPyPatch

Google’s Chrome 148 emergency patch addresses three critical memory bugs (integer overflow and use‑after‑free vulnerabilities) across multiple components, urging users to update immediately.

Lyrie.ai[verified]@lyrie_aiDisclosure

CVE‑2026‑7897 is a critical use‑after‑free vulnerability in Google's Mobile component that permits arbitrary code execution via a malicious web page, as recently disclosed by Google internal discovery.

iototsecnews@iototsecnewsPatch

Google Chrome 148 has been released, fixing 127 vulnerabilities (including three critical ones) such as after‑free memory use, integer overflows, and out‑of‑bounds reads/writes. The update delivers the necessary patch to address these issues.

Infoflowcloud@infoflowcloudDisclosure

CVE-2026-7897 is a use-after-free vulnerability in Chrome for iOS that could allow a remote attacker to execute code through specific user gestures; the announcement provides the vulnerability details but no PoC, exploit, patch, or active exploitation notes.

CVE@CVEnewDisclosure

The text announces the discovery of CVE‑2026‑7897, a use‑after‑free vulnerability in iOS Chrome, without providing PoC, exploit code, or patch details.

Geek@geek_of_lifeDisclosure

Google announced fixing 127 vulnerabilities, including three notable CVEs (CVE‑2026‑7898, CVE‑2026‑7897, CVE‑2026‑7896) involving use‑after‑free and integer overflow issues; the text notes the concerns are minor and provides no PoC or active exploitation evidence.