Chrome for iOS EUVD-2026-50939

The victim must be running Google Chrome on an iOS device at any version prior to 151.0.7922.72 - this flaw does not affect Chrome on any other platform. The attack requires active user interaction (UI:R per CVSS): the victim must navigate to a crafted HTML page, typically delivered via a phishing link. No special configuration is required - the flaw exists in default Chrome for iOS installations. Exploitation is limited by the need for victim-side interaction and the iOS-platform scope; attackers cannot exploit this remotely without first getting a user to open the malicious URL. The integrity impact is limited to UI misrepresentation and does not enable direct credential extraction or code execution without additional social engineering by the attacker.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N yields a score of 4.3 (Medium), indicating a network-reachable, low-complexity attack requiring no privileges but mandatory user interaction, with only low integrity impact and no confidentiality or availability effect. EPSS at 0.16% in the 6th percentile is extremely low, reflecting that mass exploitation of this class of flaw is unlikely. There is no CISA KEV listing and no known public exploit code, consistent with Chromium's own Low severity classification. Real-world risk is further bounded by the iOS-only scope and the requirement that a victim actively navigate to a crafted page. Despite the network attack vector and no-privilege requirement, this is a low-priority issue for most security teams - the impact ceiling is phishing facilitation, not system compromise. The primary concern is phishing campaigns targeting users who rely on browser UI signals to validate site legitimacy.

An attacker crafts an HTML page that triggers Chrome for iOS's UI misrepresentation flaw - for example, causing the address bar to display a trusted banking domain while the actual origin is attacker-controlled. The page is delivered to victims via phishing email or SMS; when a user taps the link and opens it in Chrome on iOS, they see a spoofed UI that mirrors a legitimate site, leading them to enter credentials or approve actions. No public exploit code is known at time of analysis, and successful execution requires the attacker to socially engineer the victim into visiting the malicious URL.