CVE Catalog
CVE-2026-11165
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.23%
14th percentile - higher than 14% of all known CVEs
Summary
In Google Chrome on iOS prior to 149.0.7827.53, a use-after-free in WebMIDI allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Risk Assessment
The vulnerability could allow an attacker to escape the browser sandbox, potentially leading to system compromise or access to sensitive data.
Recommendation
Update Google Chrome on iOS to version 149.0.7827.53 or later, which includes the fix for WebMIDI.
Original NVD description (English source)
Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)