What is the CVSS score of CVE-2026-17822?

CVE-2026-17822 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17822?

Yes, a patch is available for CVE-2026-17822. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17822

EUVD-2026-50771 MEDIUM

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-557m-fhm3-g2jc

Google Apple Information Disclosure Race Condition Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AC:H applied because CWE-362 race conditions require timing precision; all other metrics align with the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:30 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page

Delivery

Lure iOS Chrome user via phishing link

Exploit

User visits page in Chrome for iOS

Execution

Race condition triggered in UI layer

Persist

Browser displays spoofed origin/security indicator

Impact

User deceived into trusting attacker-controlled content

Access

Host crafted HTML page

Delivery

Lure iOS Chrome user via phishing link

Exploit

User visits page in Chrome for iOS

Execution

Race condition triggered in UI layer

Persist

Browser displays spoofed origin/security indicator

Impact

User deceived into trusting attacker-controlled content

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to use Google Chrome on an iOS device running a version prior to 151.0.7922.72 and to actively visit a crafted HTML page (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, no-privileges-required flaw that requires a single user interaction (visiting a crafted page), with High integrity impact and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that deliberately triggers a race condition in Chrome for iOS's UI update logic - for example, rapidly initiating navigation or manipulating page content during a concurrent UI refresh - causing the address bar or origin indicator to display a spoofed, trusted domain while the user is actually viewing attacker-controlled content. The victim is lured to the page via a phishing link, social media post, or QR code; upon visiting, the spoofed UI may convince them to enter credentials or approve permissions for what appears to be a legitimate site. …
Remediation	Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the stable channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.