What is the CVSS score of CVE-2026-17835?

CVE-2026-17835 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17835?

Yes, a patch is available for CVE-2026-17835. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17835

EUVD-2026-50584 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-2mqq-97jw-22rf

Information Disclosure Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered spoofing requires victim to visit a crafted page (UI:R, PR:N); only integrity is impacted via UI deception (I:H); no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:38 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's iOS-specific code improperly handles certain HTML constructs, allowing attacker-controlled pages to render or manipulate UI chrome elements in misleading ways. On iOS, Chrome is required by Apple to use the WKWebView rendering engine rather than Blink, which introduces platform-specific rendering and navigation handling paths that may diverge from Chrome's behavior on other operating systems. This divergence creates opportunities for inconsistent treatment of HTML/CSS constructs that govern how browser UI overlays, address bar content, or security dialogs are rendered. The flaw is explicitly scoped to the iOS implementation and does not affect Chrome on Android, Windows, macOS, or Linux, as confirmed by the description and CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*).

RemediationAI

Vendor-released patch: version 151.0.7922.72 for Chrome on iOS. Users should update Google Chrome on their iOS devices to 151.0.7922.72 or later through the Apple App Store immediately; the update is confirmed by the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at https://issues.chromium.org/issues/517801739. As a compensating control for users or enterprises unable to update immediately, restrict navigation in Chrome for iOS to trusted internal resources via MDM policy, and advise users to open externally-sourced links in Safari (which uses a different rendering path) rather than Chrome. The trade-off of the Safari workaround is loss of Chrome-specific features and session state. Enterprise MDM-enforced browsing policies should be evaluated against operational needs.