EUVD-2026-50771
GHSA-557m-fhm3-g2jc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure iOS Chrome user via phishing link
-
ExploitUser visits page in Chrome for iOS
-
ExecutionRace condition triggered in UI layer
-
PersistBrowser displays spoofed origin/security indicator
-
ImpactUser deceived into trusting attacker-controlled content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome on an iOS device running a version prior to 151.0.7922.72 and to actively visit a crafted HTML page (UI:R per CVSS). No authentication or elevated privileges are required from the attacker's side (PR:N). The race condition is inherent to Chrome's iOS-specific UI rendering path, meaning no special server-side configuration or non-default Chrome setting is needed beyond the user browsing to the malicious page. Exploitation is limited to iOS devices - Chrome on Android, Windows, macOS, and Linux are not affected by this specific vulnerability. The timing-dependent nature of the race (CWE-362) may impose a practical reliability constraint not reflected in the vendor's AC:L assignment. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, no-privileges-required flaw that requires a single user interaction (visiting a crafted page), with High integrity impact and no confidentiality or availability impact. The vendor-assigned AC:L conflicts with the CWE-362 classification - race conditions inherently depend on timing of concurrent operations, which typically warrants AC:H; this discrepancy should be verified against Chromium bug tracker details. EPSS at 0.17% (7th percentile) indicates very low probability of broad exploitation in the near term. No KEV listing and no public proof-of-concept are identified at time of analysis. Tags include 'Information Disclosure,' which conflicts with the CVSS C:N metric - either the tag is imprecise or there is a minor information leak not fully captured in the vector; this warrants clarification. Overall, this is a medium-priority patch: real-world risk is constrained by the iOS-only attack surface, user interaction requirement, low EPSS, and absence of public exploit code, but the High integrity impact means successful exploitation could enable phishing or security-bypass scenarios against Chrome iOS users. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that deliberately triggers a race condition in Chrome for iOS's UI update logic - for example, rapidly initiating navigation or manipulating page content during a concurrent UI refresh - causing the address bar or origin indicator to display a spoofed, trusted domain while the user is actually viewing attacker-controlled content. The victim is lured to the page via a phishing link, social media post, or QR code; upon visiting, the spoofed UI may convince them to enter credentials or approve permissions for what appears to be a legitimate site. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the stable channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until the update is applied, users should avoid visiting untrusted or unsolicited web pages in Chrome on iOS, as exploitation requires visiting a crafted HTML page. Enterprises managing iOS fleets via MDM should push the updated Chrome version through their mobile device management policy. No documented workarounds short of updating are available; switching to Safari on iOS for sensitive browsing (e.g., banking, corporate portals) is an interim compensating measure with the trade-off of losing Chrome-specific features.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-362 denotes a race condition in which concurrent operations share a resource without adequate synchronization, creating exploitable timing windows. In the browser context, this affects Chrome's iOS-specific rendering or navigation stack (distinct from the desktop Chromium codebase), where competing threads or asynchronous events can briefly place the UI in an inconsistent state. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome platforms, but the EUVD entry (EUVD-2026-50771) and the CVE description both scope this exclusively to Chrome on iOS prior to 151.0.7922.72. The affected Chromium issue is tracked at issues.chromium.org/issues/517621178. The race likely occurs in UIWebView, WKWebView, or Chrome's own navigation bar management layer on iOS, where security-sensitive UI updates can be interleaved with attacker-controlled page transitions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H applied because CWE-362 race conditions require timing precision; all other metrics align with the vendor vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB