EUVD-2026-50584
GHSA-2mqq-97jw-22rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page exploiting iOS Chrome UI rendering
-
DeliveryHost page on attacker-controlled infrastructure
-
ExploitDeliver phishing link to iOS Chrome user via email or SMS
-
ExecutionVictim clicks link, Chrome renders spoofed UI element
-
PersistUser trusts fabricated security indicator or address bar
-
ImpactUser submits credentials or sensitive data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on an iOS device with a version prior to 151.0.7922.72. The attacker must be able to induce the victim to navigate to an attacker-controlled HTML page - delivery via phishing link, malicious advertisement, or QR code are the realistic vectors (CVSS UI:R). No attacker authentication or account on the target system is required (PR:N). The flaw is strictly iOS-platform-specific; Android, Windows, macOS, and Linux Chrome users are not affected. Exploitation is further limited by the need for active user interaction: victims who do not open the crafted link cannot be targeted. There is no evidence of exploitation against non-default configurations - the vulnerability is expected to be triggerable against default Chrome for iOS installations. |
| Impact | The CVSS base score of 6.5 (Medium) is consistent with a network-reachable spoofing flaw that demands user interaction (UI:R) and delivers no confidentiality or availability impact - only an Integrity:High rating reflecting the deception potential. EPSS at 0.17% (7th percentile) strongly suggests that exploitation is not currently widespread or automated, placing this well below the threshold of urgent prioritization for most organizations. No CISA KEV listing and no reported public proof-of-concept reinforce this low-exploitation signal. The primary real-world risk lies in targeted phishing campaigns where attackers craft pages to impersonate trusted domains or suppress security warnings for iOS Chrome users - a realistic but not opportunistic threat profile. The combination of low EPSS, no KEV, and the user-interaction requirement (victims must visit a crafted page) means this is a lower-priority patch for most enterprises, though mobile-heavy consumer-facing organizations should treat it as routine hygiene. No conflicting signals identified; the CVSS vector and description are consistent. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page engineered to trigger Chrome for iOS's improper UI rendering, causing the browser to display a fabricated address bar or security dialog that mimics a trusted domain or suppresses a security warning. The attacker delivers the URL via phishing email, SMS, or social media to iOS users running an unpatched Chrome version. The victim, trusting the spoofed UI, submits credentials or approves a sensitive action believing they are on a legitimate site. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
RemediationAI
Vendor-released patch: version 151.0.7922.72 for Chrome on iOS. Users should update Google Chrome on their iOS devices to 151.0.7922.72 or later through the Apple App Store immediately; the update is confirmed by the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at https://issues.chromium.org/issues/517801739. As a compensating control for users or enterprises unable to update immediately, restrict navigation in Chrome for iOS to trusted internal resources via MDM policy, and advise users to open externally-sourced links in Safari (which uses a different rendering path) rather than Chrome. The trade-off of the Safari workaround is loss of Chrome-specific features and session state. Enterprise MDM-enforced browsing policies should be evaluated against operational needs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's iOS-specific code improperly handles certain HTML constructs, allowing attacker-controlled pages to render or manipulate UI chrome elements in misleading ways. On iOS, Chrome is required by Apple to use the WKWebView rendering engine rather than Blink, which introduces platform-specific rendering and navigation handling paths that may diverge from Chrome's behavior on other operating systems. This divergence creates opportunities for inconsistent treatment of HTML/CSS constructs that govern how browser UI overlays, address bar content, or security dialogs are rendered. The flaw is explicitly scoped to the iOS implementation and does not affect Chrome on Android, Windows, macOS, or Linux, as confirmed by the description and CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered spoofing requires victim to visit a crafted page (UI:R, PR:N); only integrity is impacted via UI deception (I:H); no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB