CVE-2026-78957 Google CVE debrief

Who should care

IT administrators and security teams responsible for managing Google Chrome installations on iOS devices should be aware of this vulnerability and take necessary actions to mitigate the risk. They should review Chrome updates, implement compensating controls, and conduct inventory checks to identify and update vulnerable installations. Security teams should also monitor for potential exploitation attempts and review logs for exposed assets that need extra review. Additionally, operators and platform administrators should be informed about the potential impact on their systems and take steps to ensure their environments are secure. Vulnerability management and security teams should prioritize this issue due to the local attack vector and potential for sensitive information disclosure. They should also consider the affected product scope and review context to ensure proper mitigation and remediation efforts are in place. This vulnerability may require additional review and verification to ensure proper mitigation and remediation efforts are in place, especially in environments with high security sensitivity or exposure to crafted files. Therefore, a thorough review of the official advisory and CVE record is necessary to validate affected scope, severity, and vendor guidance. IT administrators and security teams should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. They should check relevant monitoring, detection, and logs for exposed assets that need extra review and consider the permissions required for affected systems and components. This may involve coordinating with other teams, such as IT operations or development, to ensure a comprehensive response to the vulnerability. By taking these steps, organizations can help minimize the risk associated with this vulnerability and ensure the security of their systems and data. The vulnerability's impact on different operators and platforms should be carefully assessed to ensure that all necessary precautions are taken. This includes reviewing the affected scope

Technical summary

The vulnerability, CVE-2026-78957, is an information leak issue in Google Chrome on iOS, affecting versions prior to 152.0.7977.65. A local attacker can exploit this vulnerability using a crafted file to obtain sensitive information. The vulnerability has a CVSS score of 5.5, indicating a medium severity level. Defenders should verify Chrome version 152.0.7977.65 or later is installed and monitor for suspicious file activity. The CVE description and NVD details provide limited information about the vulnerability, suggesting a crafted file is involved.

Defensive priority

Medium-priority defensive review recommended due to local attack vector and potential for sensitive information disclosure.

Recommended defensive actions

• Review and apply Google Chrome updates to ensure version 152.0.7977.65 or later is installed.
• Implement compensating controls to monitor and restrict crafted file execution.
• Conduct inventory checks to identify and update vulnerable Google Chrome installations on iOS devices.

Evidence notes

Evidence from official CVE and NVD sources indicates an information leak vulnerability in Google Chrome on iOS. The CVE description and NVD details provide limited information about the vulnerability, suggesting a crafted file is involved. Defenders should verify Chrome version 152.0.7977.65 or later is installed and monitor for suspicious file activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.