What is the CVSS score of CVE-2026-18016?

CVE-2026-18016 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18016?

Yes, a patch is available for CVE-2026-18016. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-18016

EUVD-2026-50942 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-569f-g5j2-m5r8

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML with no auth needed, but mandatory user navigation (UI:R); impact is integrity-only via UI spoofing with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.

Technical ContextAI

CWE-346 (Origin Validation Error) indicates the browser's policy enforcement layer fails to correctly validate or restrict the origin context of content rendered by a crafted page, enabling that page to produce UI elements that impersonate trusted browser chrome or navigation indicators. This class of flaw is particularly impactful on mobile platforms such as iOS where the browser chrome (address bar, security indicators) occupies limited screen real estate and users rely heavily on those visual cues to assess page legitimacy. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to the iOS platform, covering all Chrome for iOS releases prior to 151.0.7922.72. The issue is specific to the iOS code path, distinguishing it from desktop Chrome builds; Chromium's internal severity rating is Low, consistent with the constrained impact scope.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later, which contains the vendor-released patch; this is the only confirmed fix. Users should update via the Apple App Store. The advisory is available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No workarounds are documented by the vendor for this UI spoofing issue, as the flaw resides in the rendering/policy enforcement layer rather than a discretionary feature that can be disabled. If immediate patching is not possible, user-awareness training to verify URLs via copy-and-inspect rather than trusting visual browser chrome is a compensating control, though it has limited effectiveness and should not be treated as equivalent to patching.