EUVD-2026-50588
GHSA-hr24-c349-3rp3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page exploiting iOS Chrome UI rendering
-
DeliveryDeliver link via phishing or malvertising
-
ExploitVictim opens page in Chrome for iOS
-
ExecutionSpoofed browser UI displayed (fake address bar or dialog)
-
PersistVictim enters credentials or takes deceived action
-
ImpactAttacker harvests sensitive input
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | User interaction is required (CVSS UI:R) - the victim must navigate to or be redirected to an attacker-controlled HTML page within Chrome for iOS. No authentication or special privileges are required of the attacker (PR:N). The attack surface is limited exclusively to Google Chrome running on iOS; Chrome on other platforms is not affected by this code path. No special server-side configuration is needed. Exploitation is constrained by: (1) platform specificity - iOS Chrome users only; (2) mandatory user interaction - passive network positioning is insufficient; (3) social engineering dependency - the attacker must lure the user to a crafted page. The non-default condition is therefore the user's browser choice on their mobile device, not a server configuration flag. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N represents a network-delivered, low-complexity attack requiring no privileges but requiring user interaction - the victim must visit the attacker's page. The High integrity score reflects the consequence of successful UI deception rather than direct data modification. EPSS at 0.17% (7th percentile) is very low, indicating this is not currently being actively exploited at scale. The vulnerability is absent from CISA KEV, and no POC has been identified. Despite the relatively high CVSS base score of 6.5, real-world exploitation risk is moderate: attacks require social engineering to lure users to attacker-controlled pages, the impact is UI-layer only without direct code execution, and the fix was shipped promptly. The primary real-world risk is targeted phishing campaigns against iOS Chrome users, not opportunistic mass exploitation. The 'Information Disclosure' tag in the intelligence metadata may reflect downstream credential exposure via UI deception, not direct memory or data leakage. |
| Exploit ScenarioDerived | An attacker sends a phishing link via email or SMS to an iOS Chrome user, directing them to a crafted HTML page that exploits the UI rendering flaw to display a convincing fake address bar showing a trusted domain (e.g., a bank or corporate SSO portal). The user, seeing what appears to be a legitimate browser UI, enters credentials into an attacker-controlled form. No public POC exists for this specific issue, and execution would require user interaction - visiting the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store, as confirmed by Google's Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This is the primary and definitive fix; no configuration-level workaround fully mitigates UI spoofing flaws. If immediate updating is not possible, organizations should advise iOS users to exercise heightened caution with unsolicited links, verify address bar URLs before entering credentials, and consider restricting browsing to managed or known-safe sites via MDM policy. Switching to Safari on iOS as a temporary measure removes the vulnerable Chrome iOS code path entirely, though this may affect enterprise-managed browser configurations. No side effects of the patch have been documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 describes a class of flaws where the browser's rendering or compositing layer allows attacker-controlled content to overlap or impersonate trusted UI elements - classic 'clickjacking' cousins. In Chrome for iOS specifically, the 'inappropriate implementation' language used by the Chromium security team signals a logic or rendering pipeline defect rather than a memory corruption issue: the iOS-specific code path (distinct from Android or desktop Chrome) fails to correctly segregate or protect browser-owned UI from page-controlled content. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome versions, and the EUVD scope 'Chrome <151.0.7922.72' pins the vulnerable surface. The iOS platform context is significant because WebKit rendering constraints on iOS differ from Blink on other platforms, often producing iOS-exclusive code paths that diverge from the main Chromium codebase and receive distinct scrutiny.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted HTML requiring user visit (UI:R); no confidentiality or availability impact; integrity rated High because spoofed UI enables credential theft through user deception.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB