EUVD-2026-50577
GHSA-73mw-78wp-rfv2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft spoofing HTML page
-
DeliveryHost on attacker-controlled domain
-
ExploitDeliver phishing link via SMS or email
-
ExecutionVictim opens link in Chrome iOS
-
PersistChrome iOS renders falsified UI elements
-
ImpactVictim trusts spoofed origin and submits credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation is limited to victims running Google Chrome for iOS at a version below 151.0.7922.72 on an Apple iOS device. The attacker must induce the victim to visit a crafted HTML page - passive exploitation without any user navigation is not possible given UI:R in the CVSS vector. No authentication, special server-side configuration, or non-default browser setting is required on the attacker's side. The flaw does not affect Chrome on any other platform (Android, Windows, macOS, Linux) nor does it affect Safari or Firefox on iOS. The primary limiting factor for real-world exploitation is the requirement for active user interaction and the iOS-only scope, which reduces the addressable attack surface compared to cross-platform browser vulnerabilities. |
| Impact | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a meaningful but bounded threat: the attacker needs no credentials and the attack is low-complexity over the network, but exploitation is blocked entirely without the victim actively visiting a crafted page (UI:R). Integrity impact is rated High because successful UI spoofing can completely undermine a user's trust decisions (e.g., believing they are on a legitimate site). EPSS at 0.17% (7th percentile) is a strong signal of low real-world exploitation activity, and the vulnerability does not appear in CISA KEV. No POC exploit is referenced in any available data source. The Chromium team's own 'Medium' severity classification is consistent. For defenders, this is a genuine but lower-priority patching item - material risk in targeted phishing campaigns against Chrome iOS users, but not an emergency requiring out-of-band response. The tags include 'Information Disclosure,' which is somewhat misleading; the primary impact is integrity/UI deception rather than data exfiltration. |
| Exploit ScenarioDerived | An attacker registers a lookalike domain and serves a crafted HTML page that exploits the Chrome iOS UI flaw to render a falsified address bar showing a trusted domain (e.g., a banking site), while the actual page harvests credentials. The victim, lured via a phishing SMS or email link, sees what appears to be a legitimate origin in the browser chrome and submits sensitive information. No public exploit code is identified at time of analysis, but the attack requires only standard HTML/CSS craftsmanship, making it accessible to moderately skilled threat actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store; this is the vendor-released patch confirmed via the Chrome Releases blog advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Desktop Chrome users are not affected by this specific flaw and need not treat it as urgent on non-iOS platforms. If the App Store update cannot be applied immediately, users should be instructed to treat any unexpected browser UI behavior (address bar anomalies, unexpected security indicator changes) as suspicious, and to avoid clicking links from untrusted sources on iOS devices. There are no documented server-side compensating controls since the flaw is client-side; phishing awareness training is a valid supplementary measure but carries no technical enforcement guarantee.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where a product displays misleading or falsified information in trusted UI regions - in browser contexts, this typically manifests as address bar spoofing, security indicator manipulation, or origin masking. Chrome for iOS, unlike desktop Chrome, operates under Apple's WebKit rendering mandate (App Store policy) but retains its own browser chrome and UI layer distinct from the rendering engine. The 'inappropriate implementation' phrasing is Google's canonical label for logic or design errors in feature-specific code. In this case, the flaw resides in the iOS-specific implementation, as opposed to the shared Chromium codebase used across platforms - explaining why it is scoped to iOS rather than all Chrome versions despite the broad CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The CPE wildcard covers all Chrome, but the vulnerability is iOS-exclusive per the description and EUVD affected range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted HTML with no attacker privileges; UI:R because victim must navigate to page; I:H because complete falsification of browser chrome undermines all user security decisions; C:N and A:N because spoofing alone does not exfiltrate data or disrupt service.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB