Chrome for iOS EUVD-2026-34746

The victim must be running Google Chrome on iOS (iPhone or iPad) with any Chrome version below 149.0.7827.53 - this vulnerability does not affect Chrome on Android, macOS, Windows, or Linux, nor does it affect Safari or other iOS browsers. Exploitation requires the victim to visit a crafted HTML page (CVSS UI:R), meaning passive network exposure is not sufficient; the attacker must induce navigation. No authentication, no special server-side configuration, and no non-default browser settings are required on either side. Exploitation is limited to UI integrity impact - an attacker cannot exfiltrate data or execute code through this vulnerability alone.

CVSS 4.3 (Medium) is consistent with the narrow impact: integrity-only, user-interaction-required, no privilege escalation, unchanged scope. Chromium's internal severity rating of Low further confirms this is not a critical priority. EPSS at 0.03% (11th percentile) indicates extremely low exploitation probability among the broader CVE population. The vulnerability is not listed in the CISA KEV catalog, and no POC or active exploitation has been reported. The primary real-world risk is social engineering amplification - an attacker could use UI spoofing to impersonate a trusted site or suppress security warnings, enabling phishing on iOS Chrome users. However, the requirement for user interaction and the absence of any code execution or data exfiltration path significantly limits the blast radius. This is a low-priority patch for most organizations, elevated only for deployments managing iOS devices where Chrome is the mandated browser.

An attacker registers a domain crafted to impersonate a legitimate service and hosts an HTML page that exploits Chrome for iOS's inappropriate UI implementation to alter or obscure the address bar or security indicators. A victim using Chrome on an iPhone or iPad visits the link - delivered via SMS, email, or social media - and is shown a spoofed UI that misrepresents the page origin or security state, potentially enabling credential harvesting. No public exploit code exists at time of analysis, and exploitation requires the victim to actively navigate to the attacker's page.