Chrome for iOS CVE-2026-17972

The victim must be running Google Chrome on an iOS device with a version prior to 151.0.7922.72. Exploitation requires the victim to actively navigate to or open a link to the attacker's crafted HTML page - a deliberate user interaction (UI:R) that limits mass automated exploitation. No authentication to the target system is required on the attacker's part (PR:N). The vulnerability is iOS-platform-specific and does not affect Chrome on other operating systems. Limiting factors include the requirement for user interaction, iOS platform restriction, and the relatively narrow window between disclosure and the widely available App Store patch.

Real-world priority is low. The CVSS base score of 4.3 reflects limited integrity-only impact with no confidentiality or availability consequence. The attack vector is network-accessible and requires no privileges (PR:N), which elevates theoretical reach, but the mandatory user interaction (UI:R) substantially reduces automatable exploitation - confirmed by SSVC's 'Automatable: no' classification. EPSS at 0.17% places this in the 7th percentile globally, meaning roughly 93% of CVEs are assessed as more likely to be exploited in the near term. CISA KEV status is absent and SSVC exploitation is listed as 'none', both corroborating the low-urgency posture. The primary threat model is targeted phishing: an attacker who can socially engineer a victim to visit a malicious page may be able to spoof a trusted site's identity within the browser, a meaningful but non-critical risk for most enterprises.

An attacker hosts a crafted HTML page that exploits the UI rendering flaw in Chrome for iOS, causing the browser's address bar, security badge, or modal UI to display false origin or trust information. The attacker distributes a link to this page via email, SMS, or messaging app; a victim on an unpatched iOS device taps the link, Chrome renders the spoofed UI, and the victim is deceived into believing they are interacting with a legitimate site - potentially leading to credential submission or permission grants. No public proof-of-concept exploit code has been identified at time of analysis.