Description
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an inappropriate implementation in Chrome for iOS that allows a remote attacker to perform UI spoofing via a crafted HTML page. The primary impact is that users may see a forged interface that mimics legitimate content, potentially leading them to interact with malicious elements. This UI spoofing flaw is categorized under CWE-451.

Affected Systems

Google Chrome on iOS versions prior to 151.0.7922.72 are vulnerable. Users running these versions are at risk.

Risk and Exploitability

The issue is rated as Medium severity by Chromium, with an EPSS score of less than 1%, indicating a very low exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted HTML page that is viewed by the user in the vulnerable browser, exploiting the UI spoofing flaw.

Generated by OpenCVE AI on August 3, 2026 at 12:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on iOS to version 151.0.7922.72 or later, the version that contains the fix for the UI spoofing issue.
  • Avoid opening HTML pages from untrusted or suspicious sources until the browser is updated.
  • Use security extensions or device management policies that block known phishing sites to reduce the risk of encountering spoofed content.

Generated by OpenCVE AI on August 3, 2026 at 12:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Mon, 03 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Crafted HTML Page

Fri, 31 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T16:08:31.595Z

Reserved: 2026-07-27T23:34:59.108Z

Link: CVE-2026-17828

cve-icon Vulnrichment

Updated: 2026-07-31T16:07:44.023Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:46.367

Modified: 2026-08-03T17:40:22.860

Link: CVE-2026-17828

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:15:03Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information