CVE-2024-9126CWE-416

CVE-2024-9126

High · published November 14, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

⚡ A crafty series of UI gestures could lead to heap corruption in Google Chrome on iOS! Just imagine a sneaky magician pulling a rabbit from the wrong hat! 🎩 Think of it like trying to open a door with the wrong key — the door might give way, but in this case, it could cause a pile-up of chaos inside the room! The same happens when the browser’s memory mishandles certain actions, leading to serious instability. An attacker could exploit this vulnerability to crash the browser or possibly execute arbitrary code, making everything from sensitive data exposure to total system compromise a real risk! Talk about a game-changer for mischief-makers!

Put simply

Think of it like trying to open a door with the wrong key — the door might give way, but in this case, it could cause a pile-up of chaos inside the room! The same happens when the browser’s memory mishandles certain actions, leading to serious instability. This vulnerability in Google Chrome on iOS stems from a use-after-free flaw, where memory is improperly managed during specific user interface interactions, enabling potential heap corruption.

What to do

An attacker could exploit this vulnerability to crash the browser or possibly execute arbitrary code, making everything from sensitive data exposure to total system compromise a real risk! Talk about a game-changer for mischief-makers! Update Google Chrome to version 127.0.6533.88 or later to mitigate the risk. Additionally, encourage users to be cautious with their gestures while using the browser until they can apply the patch. You’ve got this! Stay proactive, and your browser will be safer than ever! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-14T08:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 127.0.6533.88127.0.6533.88
References (2)
EPSS history
Timeline
  • 14 NOV 02:29Z
    Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
    cvelistv5