EUVD-2026-50587
GHSA-68p7-85qf-j7qv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTML page triggering UI spoofing
-
DeliveryHost on attacker-controlled server
-
ExploitLure iOS Chrome user via phishing link
-
ExecutionVictim opens crafted page in Chrome for iOS
-
PersistAddress bar displays spoofed trusted domain
-
ImpactVictim submits credentials to attacker origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The vulnerability requires the victim to be using Google Chrome on iOS (any version prior to 151.0.7922.72) - Chrome on Android, desktop platforms, and all non-Chrome iOS browsers are unaffected. The victim must actively navigate to or be redirected to the attacker's crafted HTML page (UI:R); drive-by exploitation without any user action is not possible. No authentication, special browser configuration, or non-default settings are required on the victim's side. Exploitation is further limited to the iOS platform due to its mandatory WKWebView constraint, meaning the affected code path is distinct from desktop Chromium. The principal limiting factor is the iOS-Chrome-specific scope, which restricts the attack surface to mobile users who have Chrome installed as their browser. |
| Impact | The CVSS 3.1 score of 6.5 reflects a network-reachable, low-complexity attack requiring no privileges but needing user interaction (UI:R), with high integrity impact (I:H) and no confidentiality or availability impact. This profile is consistent with a browser spoofing flaw: the attacker cannot extract data directly, but can deceive users into believing they are on a trusted site, enabling credential theft through social engineering. EPSS at 0.17% (7th percentile) is low, indicating the security community does not observe widespread automated exploitation. There is no CISA KEV listing and no POC has been identified, making this a targeted-risk rather than broad automated-exploitation scenario. The UI:R requirement naturally limits mass exploitation - victims must actively visit or be lured to the crafted page. Despite the I:H CVSS rating, the real-world impact is primarily phishing-enablement rather than direct system compromise. Priority should be assigned based on the organization's iOS mobile user base and exposure to untrusted links. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that triggers the security UI inconsistency in Chrome for iOS, causing the address bar to display a spoofed domain - such as a banking or corporate SSO portal - while the actual content originates from an attacker-controlled host. The victim is directed to this page via a phishing email or SMS link, sees an apparently legitimate domain in Chrome's address bar, and submits credentials that are captured by the attacker. No public exploit code is known at time of analysis, but the attack requires only a web server and crafted HTML. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
RemediationAI
Vendor-released patch: 151.0.7922.72. Users should update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. The fix is detailed in the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No documented workaround exists for the underlying UI flaw; organizations that cannot immediately enforce the update should instruct iOS Chrome users to avoid clicking unsolicited or untrusted links and to verify domain authenticity through alternate means (e.g., typing URLs directly) before submitting credentials or sensitive information. MDM-managed fleets should push the updated Chrome version via enterprise app distribution channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 (User Interface Misrepresentation of Critical Information) describes failures in which security-critical UI elements - such as the address bar, origin indicator, or padlock icon - can be manipulated to display misleading information. In Chrome for iOS, this manifests as a rendering or navigation-state inconsistency specific to Apple's iOS platform, likely involving how Chrome on iOS (which must use WKWebView per Apple policy) processes certain HTML constructs, navigation events, or URL transitions. This differs from desktop Chromium's rendering pipeline, which is why the flaw is scoped exclusively to the iOS variant. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome broadly, but both the CVE description and the EUVD affected-versions entry ('Chrome < 151.0.7922.72' on iOS) confirm the iOS-specific scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted HTML requiring no privileges; victim must visit the page (UI:R); only the security UI integrity is compromised, with no confidentiality or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB