Chrome for iOS CVE-2026-17912

Exploitation requires the victim to be running Google Chrome for iOS on an Apple iOS device with a Chrome version prior to 151.0.7922.72, and to actively interact with a crafted HTML page delivered by the attacker (confirmed by CVSS UI:R). The attacker needs no authentication and no elevated access to the victim's device (CVSS PR:N). Exploitation is strictly limited to the iOS platform - Chrome on Android, Windows, macOS, and Linux is not affected by this specific flaw. The impact is confined to navigation/redirect bypass only, with no confidentiality exposure (C:N) and no availability impact (A:N), which limits the direct damage to open-redirect-based phishing chains. Non-default configurations are not required; any iOS Chrome user visiting the crafted page is potentially affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores 4.3 Medium, driven primarily by the network-accessible attack vector and no authentication requirement, tempered by mandatory user interaction (UI:R) and impact limited to low integrity (open redirect). EPSS at 0.18% (8th percentile) is very low, indicating the broader threat intelligence community sees minimal exploitation probability. No CISA KEV listing and no reported POC further support low urgency. The Chromium team's own 'Low' severity rating aligns with these signals. The realistic threat model centers on phishing chains where attackers leverage the redirect to land victims on credential-harvesting pages - a meaningful but targeted risk rather than a mass-exploitation scenario. The combination of required user interaction, iOS-platform exclusivity, and absence of C/A impact substantially reduces the real-world blast radius compared to the CVSS network vector might suggest in isolation.

An attacker sends a phishing email or SMS message to an iOS user containing a link to a malicious HTML page hosted on a legitimate-looking domain. When the victim opens the link in Chrome for iOS, the crafted page triggers the navigation restriction bypass and silently redirects the user to an attacker-controlled site mimicking a banking portal or corporate SSO login. The victim, unaware of the redirect, submits credentials to the fraudulent page. No POC has been publicly identified, so this scenario is based on the open redirect CWE-601 attack pattern and the CVSS UI:R vector.