What is the CVSS score of EUVD-2026-50891?

EUVD-2026-50891 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50891?

Yes, a patch is available for EUVD-2026-50891. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-50891

| CVE-2026-17965 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-p8gf-chcc-prm8

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring active user visit (UI:R); limited integrity-only impact from spoofed UI elements; no confidentiality, availability, or scope-change consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.

Technical ContextAI

The flaw resides in Chrome's iOS-specific security UI layer, which is responsible for rendering trust indicators such as the address bar origin, HTTPS security badges, and permission prompts. On iOS, Chrome operates within Apple's WebKit-mandated browser engine constraints while maintaining its own UI chrome layer; a logic error in this layer allows attacker-controlled HTML to trigger incorrect UI state rendering. The affected scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions on iOS prior to 151.0.7922.72. No CWE has been assigned by NVD; however, the root cause class is consistent with improper UI trust boundary enforcement, where attacker-supplied content influences the rendering of browser-managed security signals that users rely upon to assess page legitimacy.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later, which contains the vendor-released fix per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; the update is delivered via the Apple App Store. No specific documented workaround exists; if immediate patching is not feasible, organizations should advise iOS Chrome users to exercise heightened caution with unfamiliar links, rely on OS-level anti-phishing protections, and avoid entering credentials on pages reached via untrusted links until the update is applied. Delaying the App Store update in a managed environment is a trade-off that prolongs exposure and is not recommended.