EUVD-2026-50623
GHSA-84vc-7gj3-39jx
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-delivered with no attacker privileges; UI:R required; spoofing implies limited integrity impact (I:L) over the vendor's I:N; no availability impact applies to UI deception.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Technical ContextAI
The vulnerability stems from an 'inappropriate implementation' within Chrome's iOS-specific rendering or navigation UI layer - a category Chromium uses for logic and design flaws distinct from memory corruption. On iOS, Chrome is constrained by Apple's WebKit rendering engine requirement; however, Chrome's own chrome UI chrome (address bar, security indicators, permission prompts) is implemented natively and is the likely locus of this spoofing issue. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to iOS builds. No CWE was assigned by NVD, which is consistent with Chromium's internal classification of implementation-quality issues outside standard weakness taxonomy. The 'Information Disclosure' tag suggests the spoofed UI can be leveraged to extract or conceal security-sensitive context such as the origin shown in the address bar or SSL/TLS indicators.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No workaround is documented in the available references. As a compensating control pending update, users can avoid navigating to untrusted or unsolicited URLs in Chrome for iOS, particularly those received via messaging apps or email, since exploitation requires visiting a crafted HTML page. Switching temporarily to Safari on iOS eliminates exposure to this specific flaw, though this trades off Chrome-specific features and session continuity. Enterprise MDM administrators (e.g., Jamf, Intune) managing iOS fleets should push the Chrome update via managed app deployment to ensure consistent remediation across devices.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today