EUVD-2026-40810
GHSA-vqw9-r72x-73gr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted HTML with no privileges needed; user must navigate to the page (UI:R); impact is integrity-only (URL bar spoofing), no data exfiltrated or service disrupted.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Technical ContextAI
CWE-451 describes a class of flaw where the browser's user interface misrepresents security-critical information - in this case, the Omnibox, which is the primary trust anchor iOS Chrome users rely on to verify site identity before submitting credentials or sensitive data. Chrome for iOS operates on Apple's WKWebView rendering stack rather than Blink directly, introducing platform-specific navigation and rendering behaviors that can diverge from desktop Chrome and create edge cases in URL bar update logic. A crafted HTML page - likely exploiting navigation timing, history manipulation, or iframe/redirect sequences - triggers a state where the rendered URL bar content no longer matches the actual document origin. The affected CPE scope is Google Chrome on iOS, specifically all versions prior to 150.0.7871.47.
RemediationAI
Update Google Chrome on iOS to version 150.0.7871.47 or later, which resolves this issue per the vendor advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates are delivered via the Apple App Store. If immediate update is not possible for managed device deployments, administrators should reinforce user security training to verify URLs through alternative means (e.g., long-pressing links before navigation, using Safari with its distinct rendering pipeline as a temporary alternative for sensitive transactions). There are no configuration knobs within Chrome for iOS that disable the Omnibox display, so the only complete fix is the vendor patch. No workaround fully compensates for the spoofing risk without switching browsers.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today