EUVD-2026-50867
GHSA-r3q2-xphw-5jj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryDeliver link to victim via phishing or redirect
-
ExploitVictim visits page in Chrome for iOS
-
ExecutionOmnibox displays spoofed URL
-
ImpactVictim submits credentials to attacker-controlled origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | The victim must be using Google Chrome on iOS (not macOS or Android) running a version prior to 151.0.7922.72, and must actively navigate to or be redirected to the attacker's crafted HTML page (user interaction required, consistent with UI:R in the CVSS vector). No authentication or account privileges are required of the attacker. The flaw is limited to iOS due to platform-specific Omnibox implementation differences; desktop Chrome and Android Chrome are not listed as affected. Exploitation is not automatable per SSVC, meaning mass-scale drive-by exploitation is not the expected threat model. |
| Impact | The aggregate risk signals consistently point to a low-priority item. CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects network reachability but requires user interaction and produces only limited integrity impact - no confidentiality or availability loss. EPSS at 0.21% (11th percentile) indicates minimal expected exploitation activity within the next 30 days. SSVC corroborates this: exploitation status is none, the attack is not automatable, and technical impact is only partial. This is not a KEV-listed vulnerability, and no POC has been identified. The combination of required user interaction, iOS-only scope, and low EPSS suggests this is a real but non-urgent issue - meaningful in phishing-chain contexts but unlikely to be mass-exploited. No conflicting signals exist in the available data. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that exploits the Omnibox rendering flaw to display a trusted domain (e.g., a banking or SSO portal URL) while the actual origin differs. The victim is lured to the attacker-controlled page via a phishing link, social engineering, or a compromised ad network, and enters credentials or sensitive information believing the Omnibox confirms a legitimate site. No exploit code is publicly available, so this scenario requires independent discovery and exploitation of the implementation flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
RemediationAI
The vendor-released patch is Chrome 151.0.7922.72 for iOS; users should update immediately via the Apple App Store. The release advisory is available at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because this is a client-side browser flaw, there are no server-side mitigations available to site operators. As a compensating control where immediate update is not possible, users and organizations should exercise heightened scrutiny when authenticating to sensitive sites on iOS Chrome by independently verifying URLs through bookmarks or typed navigation rather than trusting displayed Omnibox content. Enterprise MDM solutions (e.g., via Google Chrome Enterprise or Apple DEP) can be used to enforce minimum browser version policies and push updates. No known workaround eliminates the spoofing surface without updating the browser.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI elements can be manipulated to mislead the user. The Omnibox is Chrome's unified address and search bar - the primary mechanism by which users verify site identity. An 'inappropriate implementation' in the iOS-specific rendering of this component allows crafted HTML to influence what URL or content is displayed, breaking the visual trust indicator. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome builds, but the vulnerability is scoped to the iOS platform, where Chrome's rendering and UI management differ from desktop due to Apple's WebKit rendering requirements and iOS UIKit constraints. The EUVD confirms the affected range as all Chrome versions below 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered spoofing requiring user page visit; no privileges needed; only UI integrity impact with no confidentiality or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB