Chrome for iOS CVE-2026-17782

The victim must be running Google Chrome on an iOS device with a version prior to 151.0.7922.72 - this flaw does not affect Chrome on Android, Windows, macOS, or Linux. The attacker must induce the victim to navigate to a crafted HTML page (CVSS UI:R - one user interaction required, typically clicking a link). No authentication, elevated privileges, or special server-side configuration is required on the attacker side (CVSS PR:N). Exploitation is structurally limited by the iOS-only scope, the user-interaction requirement, and the fact that Chrome for iOS competes with Safari as the default browser, reducing the overall exposed population. The spoofing is a display-layer deception only; actual network connections still go to the attacker's domain, meaning TLS certificate inspection on the network layer would reveal the true destination.

The CVSS 4.3 Medium score reflects a constrained impact profile: I:L (integrity only, no confidentiality or availability loss), UI:R (requires victim navigation to attacker content), and S:U (scope unchanged - attacker cannot break out to the broader system). EPSS at 0.21% in the 11th percentile is notably low, and SSVC's Exploitation: none, Automatable: no, Technical Impact: partial assessment corroborates low real-world urgency. No KEV listing and no POC are confirmed. In practice, Omnibox spoofing carries outsized phishing risk relative to its CVSS score - the address bar is the primary trust signal for non-technical users - but the non-automatable SSVC rating means mass campaign exploitation is structurally difficult. The realistic risk is targeted spear-phishing rather than opportunistic mass exploitation. The CVSS signal (medium) and SSVC signal (low urgency) are consistent here and do not conflict.

An attacker registers a convincing lookalike domain and hosts a crafted HTML page that exploits Chrome for iOS's Omnibox rendering to display a trusted domain (e.g., a banking or corporate SSO URL) in the address bar while the actual loaded content is attacker-controlled. The attacker delivers the link via phishing email, SMS, or social media to iOS Chrome users, who, seeing a familiar URL in the address bar, are deceived into submitting credentials or sensitive information. No public POC exists, but the Omnibox spoofing technique is well-documented in prior Chromium bug history and requires no exploit tooling beyond standard HTML and JavaScript.