Chrome for iOS CVE-2026-17917

Exploitation requires the victim to be running Google Chrome for iOS on an Apple iOS device with a Chrome version below 151.0.7922.72. The attacker must deliver a crafted HTML page and the victim must actively open it in Chrome for iOS (UI:R per CVSS - passive or drive-by exploitation without any user interaction is not possible). No attacker authentication or privileges are required (PR:N). The vulnerability is scoped exclusively to the iOS build of Chrome; users on desktop Chrome, Chrome for Android, or Safari are not affected by this specific flaw. The non-automatable SSVC classification further indicates that bulk, scripted exploitation across large populations is not feasible, limiting realistic risk to more targeted delivery scenarios.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a medium-severity vulnerability: network reachable, low complexity, no attacker privileges, but requiring user interaction, with high integrity impact limited to the browser's scope. EPSS at 0.18% (8th percentile) signals very low current exploitation probability, consistent with SSVC's exploitation classification of none and automatable classification of no. SSVC technical impact is partial, aligning with the bounded scope (S:U) and absence of confidentiality or availability impact. No KEV listing exists and no public exploit code has been identified. The vulnerability is iOS-platform-specific, further constraining the exploitable population to Chrome for iOS users running versions below 151.0.7922.72. Combined, these signals indicate this is a real but lower-priority issue: a patch should be applied, but there is no evidence of active exploitation or weaponized tooling that would warrant emergency response.

An attacker registers or compromises a website and serves a specially crafted HTML page designed to trigger Chrome for iOS's insufficient policy enforcement. The attacker then distributes a link to that page via phishing email, SMS, or social media to target iOS Chrome users; once a victim opens the link in Chrome for iOS on an unpatched device, the crafted page circumvents discretionary access controls, allowing the attacker to achieve unauthorized integrity impacts within the browser's content context. No public exploit code is currently known, limiting this scenario primarily to motivated, targeted actors rather than commodity exploitation.