What is the CVSS score of CVE-2026-17822?

CVE-2026-17822 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17822?

Yes, a patch is available for CVE-2026-17822. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17822

EUVD-2026-50771 MEDIUM

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-557m-fhm3-g2jc

Information Disclosure Google Apple Race Condition

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AC:H applied because CWE-362 race conditions require timing precision; all other metrics align with the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:30 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.

Technical ContextAI

CWE-362 denotes a race condition in which concurrent operations share a resource without adequate synchronization, creating exploitable timing windows. In the browser context, this affects Chrome's iOS-specific rendering or navigation stack (distinct from the desktop Chromium codebase), where competing threads or asynchronous events can briefly place the UI in an inconsistent state. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome platforms, but the EUVD entry (EUVD-2026-50771) and the CVE description both scope this exclusively to Chrome on iOS prior to 151.0.7922.72. The affected Chromium issue is tracked at issues.chromium.org/issues/517621178. The race likely occurs in UIWebView, WKWebView, or Chrome's own navigation bar management layer on iOS, where security-sensitive UI updates can be interleaved with attacker-controlled page transitions.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the stable channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until the update is applied, users should avoid visiting untrusted or unsolicited web pages in Chrome on iOS, as exploitation requires visiting a crafted HTML page. Enterprises managing iOS fleets via MDM should push the updated Chrome version through their mobile device management policy. No documented workarounds short of updating are available; switching to Safari on iOS for sensitive browsing (e.g., banking, corporate portals) is an interim compensating measure with the trade-off of losing Chrome-specific features.