What is the CVSS score of CVE-2026-17841?

CVE-2026-17841 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17841?

Yes, a patch is available for CVE-2026-17841. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17841

EUVD-2026-50590 MEDIUM

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-wxv5-mh96-j2gh

Google Apple Information Disclosure Race Condition Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

AC:H applied because CWE-362 race conditions require successful timing exploitation; all other metrics align with the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:39 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft HTML page exploiting UI race

Delivery

Host page on attacker-controlled server

Exploit

Deliver link via phishing or social engineering

Execution

Victim opens link in Chrome for iOS

Persist

Race condition triggers address bar / UI spoof

Impact

Victim submits credentials to spoofed interface

Access

Craft HTML page exploiting UI race

Delivery

Host page on attacker-controlled server

Exploit

Deliver link via phishing or social engineering

Execution

Victim opens link in Chrome for iOS

Persist

Race condition triggers address bar / UI spoof

Impact

Victim submits credentials to spoofed interface

Vulnerability AssessmentAI

Exploitation	The victim must actively navigate to an attacker-controlled HTML page using Google Chrome on an iOS device running Chrome prior to 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting network-reachable exploitation with low complexity but mandatory user interaction and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page that triggers a race condition in Chrome for iOS's UI rendering layer during page navigation or dialog presentation. When a victim visits the page - via a phishing link in email or messaging - the race causes browser chrome elements such as the address bar to briefly or persistently display a trusted origin, convincing the user they are on a legitimate site and prompting them to enter credentials. …
Remediation	Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. … Detailed patch versions, workarounds, and compensating controls in full report.