EUVD-2026-50623
GHSA-84vc-7gj3-39jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryDeliver link via phishing or ad
-
ExploitVictim opens page in Chrome iOS
-
ExecutionTrigger inappropriate UI implementation
-
PersistSpoof address bar or security indicator
-
ImpactDeceive user into disclosing credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The victim must be using Google Chrome on iOS (not Safari or Chrome on other platforms) running a version prior to 151.0.7922.72, and must actively navigate to or be redirected to a crafted HTML page - fulfilling the UI:R (user interaction required) condition in the CVSS vector. The CVSS vector PR:N confirms no attacker-side authentication or account is required. There is no indication of a required non-default configuration; any iOS Chrome user on an unpatched version visiting a malicious page is in scope. Exploitation is limited by: (1) iOS-only platform scope, (2) mandatory user interaction with a crafted URL, (3) impact confined to UI deception rather than code execution or data exfiltration at the OS level, and (4) Chrome's sandboxed environment on iOS constraining post-exploitation reach. |
| Impact | The CVSS 3.1 base score of 5.4 (Medium) reflects a network-delivered attack requiring no privileges (PR:N) but dependent on user interaction (UI:R) and producing only limited confidentiality and availability impact (C:L/I:N/A:L). The availability component (A:L) in the vendor-provided vector is atypical for a UI spoofing class and may reflect edge-case browser instability; confidentiality loss is the more directly applicable impact. EPSS at 0.18% (8th percentile) strongly corroborates low automated exploitation pressure - this is not a vulnerability attracting active tooling. Absence from CISA KEV and absence of confirmed POC reinforce this. Real-world risk is narrowed further by the iOS-only scope, reducing the attack surface to Chrome users on Apple mobile devices. The primary practical risk is targeted phishing or social engineering amplified by convincing address bar or permission UI spoofing. This is a genuine but low-urgency issue: patch on normal update cadence rather than emergency response. |
| Exploit ScenarioDerived | An attacker delivers a link to a crafted HTML page - via phishing email, SMS, or a malicious advertisement - to a victim using Chrome on iOS. When the victim opens the link in Chrome for iOS prior to 151.0.7922.72, the page triggers the UI spoofing flaw, manipulating the address bar or security indicators to display a trusted origin (e.g., a banking domain) while serving attacker-controlled content, potentially harvesting credentials entered by the deceived user. No public proof-of-concept code has been identified, so exploitation currently requires independent rediscovery of the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No workaround is documented in the available references. As a compensating control pending update, users can avoid navigating to untrusted or unsolicited URLs in Chrome for iOS, particularly those received via messaging apps or email, since exploitation requires visiting a crafted HTML page. Switching temporarily to Safari on iOS eliminates exposure to this specific flaw, though this trades off Chrome-specific features and session continuity. Enterprise MDM administrators (e.g., Jamf, Intune) managing iOS fleets should push the Chrome update via managed app deployment to ensure consistent remediation across devices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from an 'inappropriate implementation' within Chrome's iOS-specific rendering or navigation UI layer - a category Chromium uses for logic and design flaws distinct from memory corruption. On iOS, Chrome is constrained by Apple's WebKit rendering engine requirement; however, Chrome's own chrome UI chrome (address bar, security indicators, permission prompts) is implemented natively and is the likely locus of this spoofing issue. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to iOS builds. No CWE was assigned by NVD, which is consistent with Chromium's internal classification of implementation-quality issues outside standard weakness taxonomy. The 'Information Disclosure' tag suggests the spoofed UI can be leveraged to extract or conceal security-sensitive context such as the origin shown in the address bar or SSL/TLS indicators.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-delivered with no attacker privileges; UI:R required; spoofing implies limited integrity impact (I:L) over the vendor's I:N; no availability impact applies to UI deception.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB