Chrome for iOS CVE-2026-18003

Exploitation requires that the victim is using Google Chrome on an iOS device running a version prior to 151.0.7922.72, and that the victim navigates to or is redirected to an attacker-controlled HTML page (UI:R per the CVSS vector). The flaw is confined entirely to the iOS platform due to its implementation-specific nature; Android and desktop Chrome users are not affected. No authentication is required from the attacker's side (PR:N per CVSS). The primary limiting factor is the combination of platform specificity (iOS + Chrome, not Safari) and the mandatory user interaction step - passive server-side scanning cannot trigger this flaw, and the attacker must successfully lure the victim.

The CVSS 3.1 base score of 4.3 (Medium) reflects network reachability (AV:N), low attack complexity (AC:L), no required privileges (PR:N), required user interaction (UI:R), and limited integrity impact (I:L) with no confidentiality or availability impact. These metrics are internally consistent with a UI spoofing scenario. However, real-world risk is further tempered by multiple converging signals: EPSS at 0.19% places this in the 9th percentile of exploitation likelihood, the vulnerability is absent from CISA KEV, no POC has been identified, and Chromium's own triage assigned it 'Low' severity. The attack is constrained to iOS users running Chrome specifically - not Safari, not Chrome on Android or desktop. For most organizations, this is a patch-on-next-cycle rather than emergency response scenario. No conflicting data signals are present.

An attacker registers a convincing domain and hosts an HTML page that exploits Chrome for iOS's UI rendering flaw to overlay or replace address-bar or security-indicator elements with attacker-controlled content - for example, displaying a fake 'https://bank.example.com' address while the actual origin is malicious. The victim, seeing what appears to be a trusted site, may submit credentials or approve actions they otherwise would not. No public POC exists, but the attack requires only a browser visit, making phishing delivery the most plausible vector.