Chrome for iOS CVE-2026-17913

Exploitation requires the victim to be running Google Chrome for iOS at a version prior to 151.0.7922.72 - this flaw is iOS-platform-specific and does not affect Chrome on desktop operating systems. The victim must actively interact with a crafted HTML page (UI:R), meaning the attacker must first deliver a link that the user taps or clicks. No attacker authentication is required (PR:N), and no elevated privileges are needed on the victim device. Limiting factors: iOS-only platform constraint, mandatory user interaction with attacker-controlled content, unchanged scope (S:U meaning the exploit cannot escape the browser's security boundary), and the nature of the impact - harm depends entirely on successfully deceiving the user rather than achieving direct code execution or data exfiltration.

The CVSS 5.4 Medium score is driven by AV:N/AC:L/PR:N, indicating low-complexity unauthenticated network exploitation, but is tempered by the UI:R requirement (user must visit a crafted page) and limited C:L/A:L impact. EPSS at 0.21% (11th percentile) places this firmly in the low-probability-of-exploitation tier. No KEV listing and no referenced POC further support low immediate risk. Chromium's internal team rated this 'Low' severity - notably below the NVD-assigned CVSS 5.4 Medium - suggesting the practical attack surface or impact is narrower than raw metrics imply. The A:L (availability) component of the provided CVSS vector is worth scrutinizing: pure UI spoofing rarely produces direct availability impact, and this metric may slightly inflate the score. Overall this is a low-priority finding for most organizations; the iOS-specific scope, mandatory user interaction, low EPSS, and Chromium's own low-severity assessment all indicate limited urgency beyond routine patch management.

An attacker registers a malicious domain and hosts a crafted HTML page engineered to spoof trusted Chrome for iOS UI elements - for example, rendering fake address bar content that displays a legitimate banking domain while the actual loaded origin is attacker-controlled. The victim receives a phishing link via email or SMS, taps it in Chrome for iOS, sees familiar-looking UI, and is deceived into entering credentials or approving a sensitive permission. No public exploit code has been identified, and the 0.21% EPSS score indicates this scenario has not been observed at scale.