Chrome for iOS CVE-2026-17944

Exploitation requires a victim to be running Google Chrome on iOS on a device where Chrome version is below 151.0.7922.72 and to actively visit a crafted HTML page served by the attacker. The CVSS vector (UI:R) confirms that user interaction is a hard prerequisite - no drive-by or background exploitation path exists. The flaw is specific to Chrome's iOS implementation; Chrome on Android, Windows, macOS, and Linux is not subject to this code path. No special configuration, authentication, or elevated privileges are required on the attacker's side. Exploitation is limited by platform (iOS only), by required user navigation to a malicious page, and by the absence of any confidentiality or availability impact - limiting practical attacker utility to navigation integrity manipulation only.

All available signals converge on a low real-world risk assessment. The CVSS base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - while network-accessible with no privilege requirement, the scope is unscoped and impact is limited to partial integrity with zero confidentiality or availability consequence. EPSS at 0.18% places this in the 8th percentile, indicating that the vast majority of vulnerabilities are more likely to be exploited in practice. SSVC reinforces this: Exploitation is listed as 'none,' the attack is not automatable (user interaction required), and technical impact is only partial. The vulnerability is not listed in CISA KEV and no POC is referenced. The iOS-platform restriction further narrows the population of exploitable targets. This is a low-priority patching item outside of high-sensitivity environments where even minor navigation integrity bypasses carry compliance implications.

An attacker registers a domain and hosts a crafted HTML page containing navigation manipulation logic targeting Chrome for iOS's restriction enforcement gap. When a victim opens the page in Chrome on iOS - via a phishing link, malicious ad, or QR code - the page triggers the navigation bypass, allowing the attacker to redirect the browser to an otherwise-restricted destination or spoof navigation state. No public exploit code has been identified at time of analysis, and the user must actively interact with the malicious page.