CVE-2024-6988 is a high severity (CVSS 8.8) use after free in the Downloads component of Google Chrome on iOS before 127.0.6533.72. A crafted HTML page could cause heap corruption. The fix is in Chrome 127.0.6533.72 or later, so update the app on every iPhone and iPad.
What's affected
The record lists Google Chrome on iOS prior to 127.0.6533.72. The Chrome Releases post for the 23 July 2024 stable update lists this CVE among its 22 security fixes and credits an external researcher, with a reward of 11000 dollars. That post covers the desktop channel, where the same build number applies. It does not publish a separate iOS version string, so confirm the iOS build in the App Store listing or your mobile device management console.
The weakness is CWE-416, use after free. Chromium rated the bug High, which matches the NVD score of 8.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The record does not flag it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Note the unusual platform angle. On iOS, every browser must use Apple's WebKit engine for web content, but Chrome for iOS still ships its own code for features around it, such as how downloads are tracked. This bug sits in that Chrome layer, not in the page renderer. The advisory text does not say more than that, and the Chromium issue (349198731) was restricted when the release was published.
How to check if you're exposed
On a single device, open Chrome, go to Settings, then Google Chrome, and read the version number. Anything below 127.0.6533.72 is affected.
For a fleet, ask your MDM for the installed version of the Chrome bundle on managed iOS devices and filter for older builds. Unmanaged personal devices that open work links are harder to see, so consider a short reminder to staff.
If you track browsers as part of your software inventory, a free in-browser dependency scan will not see mobile apps, but your asset list should. Add Chrome for iOS as its own line with the version column filled in.
What to do now
- Update Chrome on iOS from the App Store to the latest release, which is well past 127.0.6533.72.
- Turn on automatic app updates on managed devices, or push the update through MDM.
- Check that no device is pinned to an old build by a deployment profile.
- Treat links from untrusted sources in mail and chat with caution until the update lands.
- Record the version in your asset inventory so the next browser CVE takes minutes to answer.
Why it matters
A use after free happens when code keeps using memory after it has been released. If an attacker can arrange what gets placed in that freed space, the program may read or write data it should not. In a browser that can lead to code running inside the app's sandbox. The fix in these cases is almost always a code change in the component, which is why updating is the only real remedy.
Browsers are a steady source of this class of bug because they parse untrusted content all day. A quick update cadence matters more than any single advisory.
Quick check
Is CVE-2024-6988 exploited in the wild?
The record does not mark it as exploited and it is not in the CISA KEV catalog. The Chrome Releases post does not say it is exploited either.
Do I need to do anything on desktop?
This record covers Chrome on iOS. The same release fixed other bugs on desktop, so keep desktop Chrome current too.
Sources
- Gold entry for CVE-2024-6988
- Chrome Releases: Stable Channel Update for Desktop, 23 July 2024
- NVD record for CVE-2024-6988
Last reviewed: 19 October 2026.
