What is the CVSS score of CVE-2026-17835?

CVE-2026-17835 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17835?

Yes, a patch is available for CVE-2026-17835. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17835

EUVD-2026-50584 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-2mqq-97jw-22rf

Google Apple Information Disclosure Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered spoofing requires victim to visit a crafted page (UI:R, PR:N); only integrity is impacted via UI deception (I:H); no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:38 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page exploiting iOS Chrome UI rendering

Delivery

Host page on attacker-controlled infrastructure

Exploit

Deliver phishing link to iOS Chrome user via email or SMS

Execution

Victim clicks link, Chrome renders spoofed UI element

Persist

User trusts fabricated security indicator or address bar

Impact

User submits credentials or sensitive data to attacker

Access

Craft malicious HTML page exploiting iOS Chrome UI rendering

Delivery

Host page on attacker-controlled infrastructure

Exploit

Deliver phishing link to iOS Chrome user via email or SMS

Execution

Victim clicks link, Chrome renders spoofed UI element

Persist

User trusts fabricated security indicator or address bar

Impact

User submits credentials or sensitive data to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Google Chrome on an iOS device with a version prior to 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 6.5 (Medium) is consistent with a network-reachable spoofing flaw that demands user interaction (UI:R) and delivers no confidentiality or availability impact - only an Integrity:High rating reflecting the deception potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page engineered to trigger Chrome for iOS's improper UI rendering, causing the browser to display a fabricated address bar or security dialog that mimics a trusted domain or suppresses a security warning. The attacker delivers the URL via phishing email, SMS, or social media to iOS users running an unpatched Chrome version. …
Remediation	Vendor-released patch: version 151.0.7922.72 for Chrome on iOS. … Detailed patch versions, workarounds, and compensating controls in full report.