EUVD-2026-50623
GHSA-84vc-7gj3-39jx
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-delivered with no attacker privileges; UI:R required; spoofing implies limited integrity impact (I:L) over the vendor's I:N; no availability impact applies to UI deception.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be using Google Chrome on iOS (not Safari or Chrome on other platforms) running a version prior to 151.0.7922.72, and must actively navigate to or be redirected to a crafted HTML page - fulfilling the UI:R (user interaction required) condition in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.4 (Medium) reflects a network-delivered attack requiring no privileges (PR:N) but dependent on user interaction (UI:R) and producing only limited confidentiality and availability impact (C:L/I:N/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker delivers a link to a crafted HTML page - via phishing email, SMS, or a malicious advertisement - to a victim using Chrome on iOS. When the victim opens the link in Chrome for iOS prior to 151.0.7922.72, the page triggers the UI spoofing flaw, manipulating the address bar or security indicators to display a trusted origin (e.g., a banking domain) while serving attacker-controlled content, potentially harvesting credentials entered by the deceived user. … |
| Remediation | Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today