What is the CVSS score of EUVD-2026-50731?

EUVD-2026-50731 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50731?

Yes, a patch is available for EUVD-2026-50731. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-50731

| CVE-2026-17782 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-w538-wwcv-92ww

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML, no privileges needed, one victim click required (UI:R); impact is display-layer integrity spoofing only (I:L), with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:37 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.

Technical ContextAI

CWE-451 (UI Misrepresentation of Critical Information) identifies failures in how browsers surface trust indicators to users - in this case the Omnibox, Chrome's combined address and search bar, which is the primary visual signal users rely on to verify page origin. The defect is isolated to the iOS build of Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), suggesting the vulnerable code path lies in iOS-specific navigation or rendering logic rather than the shared Chromium core, since this class of issue is not simultaneously reported on Android or desktop. Chromium classified this as Medium severity. URL spoofing via Omnibox manipulation typically exploits transitions between navigation states, scroll behaviors, or full-screen rendering modes that temporarily suppress or distort the address bar display.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later, available via the Apple App Store. This is the vendor-confirmed patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprises that manage iOS device fleets via MDM, push the App Store update through the managed channel to ensure uniform coverage. If immediate update is operationally blocked, the practical compensating control is to require use of Safari for sensitive browsing sessions on iOS, since the flaw is specific to Chrome for iOS; this trades one browser's attack surface for another's and may disrupt workflows dependent on Chrome extensions or enterprise SSO configurations. No server-side mitigation exists as this is a pure client-side rendering defect.