What is the CVSS score of CVE-2026-17941?

CVE-2026-17941 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17941?

Yes, a patch is available for CVE-2026-17941. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17941

EUVD-2026-50867 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-r3q2-xphw-5jj9

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requiring user page visit; no privileges needed; only UI integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:36 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI elements can be manipulated to mislead the user. The Omnibox is Chrome's unified address and search bar - the primary mechanism by which users verify site identity. An 'inappropriate implementation' in the iOS-specific rendering of this component allows crafted HTML to influence what URL or content is displayed, breaking the visual trust indicator. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome builds, but the vulnerability is scoped to the iOS platform, where Chrome's rendering and UI management differ from desktop due to Apple's WebKit rendering requirements and iOS UIKit constraints. The EUVD confirms the affected range as all Chrome versions below 151.0.7922.72.

RemediationAI

The vendor-released patch is Chrome 151.0.7922.72 for iOS; users should update immediately via the Apple App Store. The release advisory is available at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because this is a client-side browser flaw, there are no server-side mitigations available to site operators. As a compensating control where immediate update is not possible, users and organizations should exercise heightened scrutiny when authenticating to sensitive sites on iOS Chrome by independently verifying URLs through bookmarks or typed navigation rather than trusting displayed Omnibox content. Enterprise MDM solutions (e.g., via Google Chrome Enterprise or Apple DEP) can be used to enforce minimum browser version policies and push updates. No known workaround eliminates the spoofing surface without updating the browser.