What is the CVSS score of CVE-2026-17972?

CVE-2026-17972 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17972?

Yes, a patch is available for CVE-2026-17972. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17972

EUVD-2026-50898 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-3cj6-w86j-742x

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges required, mandatory user interaction, integrity-only impact limited to UI deception with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:39 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures in which the software allows UI elements that convey security-critical context - origin identity, HTTPS status, permission dialogs - to be rendered inaccurately or overridden by attacker-controlled content. Chrome for iOS (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) implements its own rendering pipeline on iOS under Apple's WebKit constraint, and 'inappropriate implementation' in this context suggests a flaw in how Chrome's iOS-specific chrome UI (e.g., omnibox, modal overlays, or fullscreen transitions) handles crafted HTML, allowing page content to obscure or mimic trusted browser UI. This class of vulnerability is commonly leveraged for phishing or to suppress security warnings.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later, as documented in the Chrome stable channel release advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The fix is delivered via the standard App Store update mechanism for Chrome on iOS; administrators managing corporate iOS fleets via MDM should push the update through their device management platform. No workarounds are documented by the vendor. While awaiting update deployment, users may reduce exposure by avoiding clicking links from untrusted sources in Chrome on iOS, though this is not a compensating control and carries no reliability guarantee against a determined attacker. The issue tracker entry at issues.chromium.org/issues/519202895 may provide additional technical context once public.