What is the CVSS score of CVE-2026-17841?

CVE-2026-17841 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17841?

Yes, a patch is available for CVE-2026-17841. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17841

EUVD-2026-50590 MEDIUM

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-wxv5-mh96-j2gh

Information Disclosure Google Apple Race Condition

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AC:H applied because CWE-362 race conditions require successful timing exploitation; all other metrics align with the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:39 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.

Technical ContextAI

CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a race condition where two or more threads or processes access a shared resource without adequate locking, producing inconsistent or attacker-influenced state. In the context of a mobile browser, race conditions in UI rendering pipelines can allow a crafted page to transiently or permanently alter browser chrome elements - such as the address bar, security indicators, or modal dialogs - in ways the user cannot distinguish from legitimate content. Chrome on iOS is distinct from desktop Chrome and from Safari: Google's browser shell and navigation UI layer sit atop Apple's mandated WebKit rendering engine, meaning the race likely resides in Google's own iOS UI orchestration code rather than in the WebKit core. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions, with EUVD data narrowing the vulnerable range to any Chrome iOS build before 151.0.7922.72.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. The fix is confirmed available per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS device fleets via MDM should push the update through App Store volume purchasing or enforce a minimum Chrome version policy. If immediate update is not possible, a compensating control is to restrict access to untrusted web destinations using a web content filter or DNS-layer security on managed devices - this reduces the attack surface by preventing users from visiting attacker-controlled pages, though it cannot fully substitute for patching and will block legitimate browsing. No configuration-level workaround within Chrome itself has been identified.