What is the CVSS score of CVE-2026-17913?

CVE-2026-17913 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17913?

Yes, a patch is available for CVE-2026-17913. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17913

EUVD-2026-50662 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-g785-hvm3-67hj

Information Disclosure Google Apple

Medium

Disputed · 5.4 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered HTML enables UI spoofing yielding deception-based confidentiality and integrity impact (C:L, I:L); no availability impact warranted for a pure UI spoofing flaw; user must visit the crafted page (UI:R).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:31 vuln.today

CVSS changed

Aug 05, 2026 - 16:22 NVD

5.4 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 5.4

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's iOS-specific rendering or navigation implementation incorrectly handles certain HTML constructs, allowing attacker-controlled content to render in a way that spoofs trusted UI elements - such as address bar content, origin indicators, or browser security dialogs - that users rely on for trust decisions. The vulnerability is confined to Google Chrome on iOS (cpe:2.3:a:google:chrome, all versions prior to 151.0.7922.72) and does not appear to affect Chrome on desktop platforms based on available data. iOS imposes WebKit rendering constraints on third-party browsers, making Chrome for iOS architecturally distinct from Chromium on other platforms, which may explain the platform-specific nature of this flaw.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed patched release per the Chrome stable channel advisory (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Pending update, users should avoid visiting untrusted or unsolicited URLs in Chrome for iOS, since exploitation requires actively navigating to a crafted page - switching to Safari or another browser for sensitive sessions is a low-disruption interim measure. Organizations using mobile device management (MDM) solutions can enforce a minimum Chrome for iOS version policy on managed devices to ensure fleet-wide compliance. No additional workarounds that eliminate the underlying flaw are identified in the available references.