What is the CVSS score of EUVD-2026-50929?

EUVD-2026-50929 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50929?

Yes, a patch is available for EUVD-2026-50929. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-50929

| CVE-2026-18003 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-95f9-pxcf-gqfv

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L), no attacker privileges needed (PR:N), user must navigate to page (UI:R), only browser UI integrity is affected (I:L), no data exposure or service disruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:32 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.

Technical ContextAI

The vulnerability resides in the iOS-specific code path of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) - likely in how Chrome for iOS renders or positions browser UI chrome elements (address bar, security indicators) relative to web content. No CWE is formally assigned, but the 'Clickjacking' tag in the intelligence data points toward a class of UI redressing or overlay-based deception where attacker-controlled HTML can obscure or mimic trusted browser interface elements. Because Apple's App Store policies require third-party browsers on iOS to use the WebKit rendering engine rather than Blink, Chrome for iOS has a distinct implementation layer atop WebKit that differs from desktop Chrome - this divergence is the likely locus of the inappropriate implementation.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed patched release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because the vulnerability requires user navigation to a crafted page (UI:R), organizations with mobile device management (MDM) policies can also enforce Chrome version minimums through app management controls as a compensating detection measure. No functional workaround exists short of switching iOS users to a different browser, which has significant usability trade-offs and is not recommended when patching the app is straightforward.