Chrome · Mobile › iOS
CVE-2026-78981
Info Disclosure in Mobile (iOS)
Overview
Low
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Crashpad dump location
- the directory returned by
common::CrashpadDumpLocation(), where Chrome for iOS keeps its crash database, including crash reports and intermediate dumps that are processed at startup. - iOS backup exclusion
- a filesystem attribute (set here through
base::apple::SetBackupExclusionfrombase/apple/backup_util.h) that tells iOS not to include a file or directory in iCloud or local device backups. - Deferred background startup
- work Chrome for iOS runs after launch, off the critical path. According to the commit message, this is where the crash-directory exclusion is now applied.
- Crash dump contents
- crash reports can hold process state from the time of the crash, so they may contain user data from the browser session (inferred; the patch does not list what the dumps contain).
Root Cause Analysis
Chrome for iOS saved its Crashpad crash database under common::CrashpadDumpLocation() without marking that directory as excluded from backups. iOS therefore copied it into iCloud and local device backups, and the crash data left the app sandbox for storage that Chrome does not control. The violated invariant is that sensitive, purely local diagnostic data stays out of device backups.
The patch adds #import "base/apple/backup_util.h" and a call to base::apple::SetBackupExclusion(common::CrashpadDumpLocation()) in crash_helper.mm. The call goes after ClearMainThreadFreezeDetectorCache() and before the dispatch_async block that records the last shutdown type, and it sets the exclusion attribute on the crash directory. No check is relaxed or reordered; the change only adds the missing attribute. The enclosing function is not named in the hunk. The commit message describes it as the deferred background startup path.
Key insight
The crash dump directory was never excluded from iCloud and local backups, so crash data could leave the device through backups. The fix sets the backup-exclusion attribute on
common::CrashpadDumpLocation() during deferred startup.Attack Path
- Crash data written
Chrome for iOS crashes or writes intermediate dumps, which are stored under
common::CrashpadDumpLocation(). - Backup captures the directory Because the directory had no backup-exclusion attribute, an iCloud or local (for example computer-based) device backup includes the crash database.
- Attacker obtains the backup An attacker with access to the victim’s backup (a compromised iCloud account, or physical or filesystem access to a computer holding a local backup) extracts the crash files (inferred; the patch does not describe a threat actor).
- Data recovered from dumps The attacker reads whatever browsing-session data the crash dumps captured (inferred).
Impact Assessment
This is a local or backup-channel information leak in Chrome for iOS only, not a bug that web content can trigger. An attacker needs access to the user’s device backups, and crash dumps must exist. What they can learn depends on the crash-dump contents, which the patch does not specify (inferred: possibly session data such as URLs or page content held in memory). The vendor advisory rates this low severity and does not report in-the-wild exploitation; NVD scores it CVSS 6.5.
Files Changed
ios/chrome/browser/crash_report/model/crash_helper.mm
Audit Directions
- Other on-disk sensitive stores on iOSAudit the directories Chrome for iOS creates (caches, snapshots, session restore data, download staging, logs, crash or freeze-detector data) to confirm each one that holds user data has backup exclusion applied.
- Timing and re-creation of exclusion attributesCheck that exclusion is applied before sensitive data is first written, and again if a directory is deleted and re-created. Here it is set during deferred startup, so crash files written earlier in a run, or before the first deferred startup after an upgrade, may still be in the window (inferred).
- Platform parityLook for the same crash or diagnostic directories on other Apple targets (for example
base::appleusers on macOS) or for sync and backup features on other platforms that could copy local-only diagnostics off the device.
Patch
From 46203153339e8c8f0a8435b56a5235b271dfd572 Mon Sep 17 00:00:00 2001
From: Justin Cohen <justincohen@google.com>
Date: Fri, 24 Jul 2026 08:01:40 -0700
Subject: [PATCH] ios: Update backup exclusion for crash directory
Set filesystem backup exclusion attributes on the crash directory
during deferred background startup.
Fixed: 533121405
Change-Id: I03f0035d5caa41f7e99c0daa6e317eedb61d5ffb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8122936
Commit-Queue: Justin Cohen <justincohen@google.com>
Reviewed-by: Olivier Robin <olivierrobin@chromium.org>
Auto-Submit: Justin Cohen <justincohen@google.com>
Cr-Commit-Position: refs/heads/main@{#1667854}
---
diff --git a/ios/chrome/browser/crash_report/model/crash_helper.mm b/ios/chrome/browser/crash_report/model/crash_helper.mm
index 81f3ea43..0cacda3e 100644
--- a/ios/chrome/browser/crash_report/model/crash_helper.mm
+++ b/ios/chrome/browser/crash_report/model/crash_helper.mm
@@ -12,6 +12,7 @@
#import <atomic>
+#import "base/apple/backup_util.h"
#import "base/auto_reset.h"
#import "base/debug/crash_logging.h"
#import "base/feature_list.h"
@@ -113,6 +114,9 @@
// Remove this after a few milestones.
ClearMainThreadFreezeDetectorCache();
+ // Exclude the crash database from iCloud / local device backups.
+ base::apple::SetBackupExclusion(common::CrashpadDumpLocation());
+
// Wait until after processing intermediate dumps to record last shutdown
// type.
dispatch_async(dispatch_get_main_queue(), ^{
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page