What is the CVSS score of CVE-2026-17839?

CVE-2026-17839 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17839?

Yes, a patch is available for CVE-2026-17839. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17839

EUVD-2026-50588 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-hr24-c349-3rp3

Information Disclosure Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML requiring user visit (UI:R); no confidentiality or availability impact; integrity rated High because spoofed UI enables credential theft through user deception.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:38 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.

Technical ContextAI

CWE-451 describes a class of flaws where the browser's rendering or compositing layer allows attacker-controlled content to overlap or impersonate trusted UI elements - classic 'clickjacking' cousins. In Chrome for iOS specifically, the 'inappropriate implementation' language used by the Chromium security team signals a logic or rendering pipeline defect rather than a memory corruption issue: the iOS-specific code path (distinct from Android or desktop Chrome) fails to correctly segregate or protect browser-owned UI from page-controlled content. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome versions, and the EUVD scope 'Chrome <151.0.7922.72' pins the vulnerable surface. The iOS platform context is significant because WebKit rendering constraints on iOS differ from Blink on other platforms, often producing iOS-exclusive code paths that diverge from the main Chromium codebase and receive distinct scrutiny.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store, as confirmed by Google's Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This is the primary and definitive fix; no configuration-level workaround fully mitigates UI spoofing flaws. If immediate updating is not possible, organizations should advise iOS users to exercise heightened caution with unsolicited links, verify address bar URLs before entering credentials, and consider restricting browsing to managed or known-safe sites via MDM policy. Switching to Safari on iOS as a temporary measure removes the vulnerable Chrome iOS code path entirely, though this may affect enterprise-managed browser configurations. No side effects of the patch have been documented.