CVE-2026-17724

Race condition in Chrome for iOS enables remote script injection

View on CVE.org
Published Jul 30, 2026 CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Description
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

A race condition in Chrome for iOS before version 151.0.7922.72 lets a remote attacker craft an HTML page that causes the browser to execute arbitrary scripts or HTML. This can result in the execution of code within the browser context, potentially compromising the integrity of the browsing session. The weakness is identified as a race condition (CWE-362) and is rated Chromium severity high.

Affected Systems

Google Chrome for iOS, versions preceding 151.0.7922.72. The vulnerability exists in any Chrome iOS build prior to this update. Users of iOS devices running older Chrome installations are at risk.

Risk and Exploitability

The EPSS score of less than 1 % indicates a low probability of automated exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.2 reflects medium severity. Exploitation requires a user to open a maliciously crafted page in Chrome for iOS, indicating a remote attack vector that relies on social engineering or phishing. If exploited, the capability to run code within the browser could compromise session integrity and privacy. The overall risk is moderate, but the potential damage warrants prompt remediation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome for iOS to version 151.0.7922.72 or later.
  • Enable automatic updates on the device to receive future fixes promptly.
  • Avoid opening suspicious links in Chrome for iOS until the update is confirmed to be installed.

Generated by OpenCVE AI on August 12, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Race condition in Chrome for iOS enables remote script injection
Type Values Removed Values Added
Title Race Condition in Chrome for iOS Enables Remote Script Injection
Type Values Removed Values Added
Title Race Condition in Chrome for iOS Enables Remote Script Injection
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-362
References
Earlier changes (1)
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jul 30, 2026, 8:57 PM
Reserved
Jul 27, 2026, 11:34 PM

View source JSON

Updated
Jul 30, 2026, 8:57 PM

JSON

Status
Analyzed
Published
Jul 30, 2026, 1:16 AM
Modified
Oct 24, 2026, 1:10 PM

View source JSON

No data.

Updated
Aug 12, 2026, 1:15 AM

JSON