What is the CVSS score of CVE-2026-17838?

CVE-2026-17838 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17838?

Yes, a patch is available for CVE-2026-17838. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17838

EUVD-2026-50587 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-68p7-85qf-j7qv

Information Disclosure Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML requiring no privileges; victim must visit the page (UI:R); only the security UI integrity is compromised, with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:38 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures in which security-critical UI elements - such as the address bar, origin indicator, or padlock icon - can be manipulated to display misleading information. In Chrome for iOS, this manifests as a rendering or navigation-state inconsistency specific to Apple's iOS platform, likely involving how Chrome on iOS (which must use WKWebView per Apple policy) processes certain HTML constructs, navigation events, or URL transitions. This differs from desktop Chromium's rendering pipeline, which is why the flaw is scoped exclusively to the iOS variant. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome broadly, but both the CVE description and the EUVD affected-versions entry ('Chrome < 151.0.7922.72' on iOS) confirm the iOS-specific scope.

RemediationAI

Vendor-released patch: 151.0.7922.72. Users should update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. The fix is detailed in the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No documented workaround exists for the underlying UI flaw; organizations that cannot immediately enforce the update should instruct iOS Chrome users to avoid clicking unsolicited or untrusted links and to verify domain authenticity through alternate means (e.g., typing URLs directly) before submitting credentials or sensitive information. MDM-managed fleets should push the updated Chrome version via enterprise app distribution channels.