What is the CVSS score of CVE-2026-17849?

CVE-2026-17849 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17849?

Yes, a patch is available for CVE-2026-17849. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17849

EUVD-2026-50598 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-48cg-r3vm-q8hq

Information Disclosure Google Apple Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing via malicious traffic requires no privileges and no special configuration, but victim navigation is mandatory; integrity impact is limited to URL bar misrepresentation with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:34 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).

Technical ContextAI

The vulnerability is rooted in an 'inappropriate implementation' within Chrome's Omnibox rendering logic as deployed on iOS, classified under CWE-451 (User Interface Misrepresentation of Critical Information). On iOS, Chrome is constrained by Apple's WebKit mandate, meaning its rendering engine differs from Chromium's desktop Blink engine; this divergence can introduce platform-specific URL-handling edge cases. The flaw allows malicious network traffic - crafted HTTP responses, redirects, or similar - to decouple the URL displayed in the Omnibox from the actual page origin being rendered. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD-2026-50598 and the Chromium issue tracker (issues.chromium.org/issues/518812672) corroborating the iOS-specific scope. Desktop and Android Chrome builds are not referenced as affected by this particular flaw.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fix as documented in the Chrome releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For users unable to update immediately, exercise heightened caution when following links from untrusted sources and verify destination URLs by long-pressing links to inspect the actual target before navigation, as the Omnibox itself cannot be trusted in the vulnerable version. Avoiding untrusted Wi-Fi networks or using a VPN reduces exposure to network-level interception that could trigger the spoofing, though this does not address server-side delivery vectors. No compensating control fully substitutes for the patch for this class of UI spoofing vulnerability.