EUVD-2026-50577
GHSA-73mw-78wp-rfv2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted HTML with no attacker privileges; UI:R because victim must navigate to page; I:H because complete falsification of browser chrome undermines all user security decisions; C:N and A:N because spoofing alone does not exfiltrate data or disrupt service.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where a product displays misleading or falsified information in trusted UI regions - in browser contexts, this typically manifests as address bar spoofing, security indicator manipulation, or origin masking. Chrome for iOS, unlike desktop Chrome, operates under Apple's WebKit rendering mandate (App Store policy) but retains its own browser chrome and UI layer distinct from the rendering engine. The 'inappropriate implementation' phrasing is Google's canonical label for logic or design errors in feature-specific code. In this case, the flaw resides in the iOS-specific implementation, as opposed to the shared Chromium codebase used across platforms - explaining why it is scoped to iOS rather than all Chrome versions despite the broad CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The CPE wildcard covers all Chrome, but the vulnerability is iOS-exclusive per the description and EUVD affected range.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store; this is the vendor-released patch confirmed via the Chrome Releases blog advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Desktop Chrome users are not affected by this specific flaw and need not treat it as urgent on non-iOS platforms. If the App Store update cannot be applied immediately, users should be instructed to treat any unexpected browser UI behavior (address bar anomalies, unexpected security indicator changes) as suspicious, and to avoid clicking links from untrusted sources on iOS devices. There are no documented server-side compensating controls since the flaw is client-side; phishing awareness training is a valid supplementary measure but carries no technical enforcement guarantee.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today