Chrome for iOS CVE-2026-17965

Exploitation requires the target to be running Google Chrome on an iOS device with any version prior to 151.0.7922.72. The victim must actively navigate to a crafted HTML page (UI:R per CVSS vector), meaning passive drive-by exploitation without user interaction is not possible. No authentication or special server-side configuration is required from the attacker's perspective (PR:N per CVSS). Key limiting factors include: iOS-only scope, which excludes all desktop and Android Chrome users; mandatory active user navigation to the malicious page; and the absence of any direct system-level access or data exfiltration as an immediate consequence. Default iOS Chrome installations running affected versions are vulnerable once a user visits an attacker-controlled page.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) characterizes this as a low-complexity network attack requiring user interaction, with limited integrity impact and no confidentiality or availability consequences, yielding a score of 4.3 (Medium). This aligns precisely with Chromium's own internal 'Low' severity classification for the issue. EPSS at 0.17% (7th percentile) strongly corroborates low real-world exploitation probability, and neither a CISA KEV entry nor public exploit code has been identified, making this a low-urgency finding for most organizations. The primary real-world risk is phishing amplification - an attacker could leverage the spoofed security UI to build victim confidence in a fraudulent page - but this requires deliberate user navigation to the malicious page and yields no direct system compromise. Overall this is a genuine but low-priority finding: address through routine update cycles rather than emergency response.

An attacker hosts a crafted HTML page engineered to trigger Chrome for iOS's incorrect security UI rendering, then lures a victim - via phishing email, SMS, or social media link - to visit the page on an unpatched iOS device. Chrome displays misleading or spoofed security indicators, causing the victim to trust the malicious page as a legitimate or secure site, enabling credential harvesting or further social engineering. No public exploit code has been identified at time of analysis.