EUVD-2026-50598
GHSA-48cg-r3vm-q8hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker controls network traffic or malicious server
-
DeliveryVictim opens Chrome for iOS and navigates to attacker content
-
ExploitMalicious network response triggers Omnibox spoofing
-
ExecutionVictim trusts fake displayed URL
-
ImpactVictim submits credentials or sensitive data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The victim must be running Google Chrome on iOS in a version prior to 151.0.7922.72 and must actively navigate to or interact with attacker-delivered content (UI:R per CVSS). The attacker must be capable of delivering malicious network traffic to the target - either via a man-in-the-middle position (e.g., rogue Wi-Fi access point) or by operating a server the victim visits directly. No authentication or privileges are required on the attacker's side (PR:N per CVSS). The vulnerability is strictly iOS-platform-specific; Chrome on desktop or Android is unaffected by this flaw. The spoofing impact is confined to the Omnibox display and does not grant code execution, data exfiltration, or availability impact. Non-iOS Chrome users are fully outside the attack surface. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) is well-calibrated for this class of vulnerability: AV:N/AC:L reflects that network-delivered exploitation is straightforward once the attacker controls relevant traffic, while UI:R meaningfully constrains mass automated exploitation. The S:U/C:N/I:L/A:N profile correctly captures a bounded integrity impact - URL bar misrepresentation - with no confidentiality leak or availability disruption attributable to the vulnerability itself. EPSS at 0.20% (10th percentile) is consistent with the absence of a public POC and the phishing-class nature of the flaw, which typically sees lower automated scanning activity than memory-corruption or RCE bugs. There is no CISA KEV listing and no confirmed POC in the provided data, so exploitation remains speculative. The practical threat is phishing and credential harvesting, not system compromise. The iOS-specific scope further limits the exposed population. Overall, this is a real but moderate-priority issue that should be remediated on a standard patch cycle rather than treated as an emergency. |
| Exploit ScenarioDerived | An attacker with a man-in-the-middle position on the victim's network, or operating a malicious web server, crafts HTTP responses or redirect sequences that cause Chrome for iOS to display a trusted domain (e.g., a bank or identity provider) in the Omnibox while rendering attacker-controlled content. The victim, trusting the displayed URL, submits login credentials or sensitive personal data to the attacker's page. No public POC exists at time of analysis; execution of this scenario also requires the victim to actively navigate to or interact with the attacker's content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fix as documented in the Chrome releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For users unable to update immediately, exercise heightened caution when following links from untrusted sources and verify destination URLs by long-pressing links to inspect the actual target before navigation, as the Omnibox itself cannot be trusted in the vulnerable version. Avoiding untrusted Wi-Fi networks or using a VPN reduces exposure to network-level interception that could trigger the spoofing, though this does not address server-side delivery vectors. No compensating control fully substitutes for the patch for this class of UI spoofing vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in an 'inappropriate implementation' within Chrome's Omnibox rendering logic as deployed on iOS, classified under CWE-451 (User Interface Misrepresentation of Critical Information). On iOS, Chrome is constrained by Apple's WebKit mandate, meaning its rendering engine differs from Chromium's desktop Blink engine; this divergence can introduce platform-specific URL-handling edge cases. The flaw allows malicious network traffic - crafted HTTP responses, redirects, or similar - to decouple the URL displayed in the Omnibox from the actual page origin being rendered. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD-2026-50598 and the Chromium issue tracker (issues.chromium.org/issues/518812672) corroborating the iOS-specific scope. Desktop and Android Chrome builds are not referenced as affected by this particular flaw.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered spoofing via malicious traffic requires no privileges and no special configuration, but victim navigation is mandatory; integrity impact is limited to URL bar misrepresentation with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via malicious network traffic. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB