Chrome for iOS CVE-2026-18016

The victim must be using Google Chrome on iOS in a version prior to 151.0.7922.72 and must actively navigate to or be redirected to a crafted HTML page (UI:R in CVSS). No authentication, special server configuration, or non-default browser settings are required on the attacker side. Exploitation is limited by the mandatory user interaction requirement, the iOS-platform specificity of the flaw, and the absence of any automatable exploitation path as confirmed by SSVC (Automatable: no). Users running Chrome on Android, Windows, macOS, or Linux are not affected by this specific CVE.

The aggregate risk signals consistently characterize this as a low-priority, low-urgency finding. The NVD CVSS 3.1 base score is 4.3 (Medium label, but toward the lower bound), driven by AV:N/AC:L/PR:N yet offset by UI:R (mandatory user interaction) and an impact ceiling of I:L with no confidentiality or availability impact. EPSS at 0.16% places this in the 6th percentile - among the least likely vulnerabilities to see exploitation in the near term. CISA SSVC corroborates this: exploitation status is none, automatable is no (UI:R precludes scripted mass exploitation), and technical impact is partial. The vulnerability is not listed in CISA KEV. Tags include 'Information Disclosure,' which may reflect that spoofed UI could facilitate phishing or credential theft as a secondary effect, but this is not a direct confidentiality breach. No conflicts between data sources are observed; all signals align toward low real-world priority.

An attacker hosts a malicious web page containing crafted HTML that exploits the origin policy enforcement gap in Chrome for iOS, then directs a victim to it via a phishing link or malicious advertisement. When the victim loads the page in an unpatched version of Chrome for iOS, the page renders spoofed browser UI elements - such as a fake address bar or security indicator - causing the victim to believe they are on a legitimate site, potentially leading to credential submission. No public exploit code has been identified at time of analysis, and successful exploitation requires the victim to actively visit the page.