EUVD-2026-50590
GHSA-wxv5-mh96-j2gh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTML page exploiting UI race
-
DeliveryHost page on attacker-controlled server
-
ExploitDeliver link via phishing or social engineering
-
ExecutionVictim opens link in Chrome for iOS
-
PersistRace condition triggers address bar / UI spoof
-
ImpactVictim submits credentials to spoofed interface
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must actively navigate to an attacker-controlled HTML page using Google Chrome on an iOS device running Chrome prior to 151.0.7922.72. Exploitation is limited strictly to the iOS platform - the race condition does not apply to Chrome on any other OS. No authentication or account privileges are required of the attacker (PR:N per CVSS). The race condition imposes an implicit timing dependency: successful UI spoofing requires the attacker's crafted page to win a specific scheduling race within Chrome's iOS UI thread, which may not be reliably reproducible across all iOS device models or iOS OS versions. User interaction is mandatory - a victim who does not visit the page cannot be affected. There is no evidence of exploitation against default Chrome iOS configurations without user navigation to the malicious page. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting network-reachable exploitation with low complexity but mandatory user interaction and no confidentiality or availability impact. The I:H rating captures the ability to fully spoof browser UI, which underpins phishing and social engineering scenarios. However, AC:L warrants scrutiny: CWE-362 race conditions inherently depend on timing windows and are rarely reliable across all device configurations, suggesting the actual attack complexity may be higher in practice than the vector implies - this is an internal discrepancy worth flagging. The EPSS score of 0.14% at the 4th percentile significantly deflates operational urgency; fewer than 4% of all CVEs are exploited less frequently than this one. No CISA KEV listing and no reported public exploit code further reduce the threat signal. The vulnerability is iOS-platform-specific, narrowing the exposed population to Chrome iOS users exclusively. Real-world risk is moderate at most: meaningful primarily to users who could be targeted in spear-phishing campaigns where a convincing URL or security-indicator spoof is required. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that triggers a race condition in Chrome for iOS's UI rendering layer during page navigation or dialog presentation. When a victim visits the page - via a phishing link in email or messaging - the race causes browser chrome elements such as the address bar to briefly or persistently display a trusted origin, convincing the user they are on a legitimate site and prompting them to enter credentials. No public proof-of-concept exists at time of analysis, and reliable exploitation likely requires device-specific timing tuning. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. The fix is confirmed available per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS device fleets via MDM should push the update through App Store volume purchasing or enforce a minimum Chrome version policy. If immediate update is not possible, a compensating control is to restrict access to untrusted web destinations using a web content filter or DNS-layer security on managed devices - this reduces the attack surface by preventing users from visiting attacker-controlled pages, though it cannot fully substitute for patching and will block legitimate browsing. No configuration-level workaround within Chrome itself has been identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a race condition where two or more threads or processes access a shared resource without adequate locking, producing inconsistent or attacker-influenced state. In the context of a mobile browser, race conditions in UI rendering pipelines can allow a crafted page to transiently or permanently alter browser chrome elements - such as the address bar, security indicators, or modal dialogs - in ways the user cannot distinguish from legitimate content. Chrome on iOS is distinct from desktop Chrome and from Safari: Google's browser shell and navigation UI layer sit atop Apple's mandated WebKit rendering engine, meaning the race likely resides in Google's own iOS UI orchestration code rather than in the WebKit core. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions, with EUVD data narrowing the vulnerable range to any Chrome iOS build before 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H applied because CWE-362 race conditions require successful timing exploitation; all other metrics align with the vendor vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB