What is the CVSS score of CVE-2026-18013?

CVE-2026-18013 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18013?

Yes, a patch is available for CVE-2026-18013. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-18013

EUVD-2026-50939 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-cvff-v6v9-2f25

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Crafted HTML delivered over the network requires only victim navigation; spoofing yields low integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:36 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.

Technical ContextAI

CWE-451 describes flaws where a product's UI fails to accurately convey critical security information to users, causing them to make trust decisions on falsified signals. On iOS, all third-party browsers - including Chrome - are mandated by Apple to use the WebKit rendering engine rather than Blink/V8, which introduces implementation divergences unique to the iOS codebase. The 'inappropriate implementation' language suggests a rendering or navigation handling quirk in Chrome's iOS-specific wrapper layer (not in Chromium desktop or Chrome on Android) that can be triggered by crafted HTML to manipulate how origin, URL, or security state is displayed. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* encompasses all Chrome versions prior to 151.0.7922.72 on the iOS platform, as confirmed by the EUVD affected-versions range.

RemediationAI

Vendor-released patch: Chrome for iOS 151.0.7922.72. Users should update Chrome on their iOS devices to version 151.0.7922.72 or later via the App Store; this is the only confirmed fix per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No configuration-based workaround is known for this UI rendering flaw, as it is inherent to the rendering layer rather than a toggleable feature. As a partial compensating control pending update, organizations can advise users to independently verify URLs via the iOS share sheet or paste links into a trusted reference rather than relying on the address bar display; however, this adds user friction and does not eliminate the spoofing surface. Enterprises using mobile device management (MDM) can enforce mandatory Chrome version compliance policies to accelerate patch rollout.