Description
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An inadequate implementation in Chrome for iOS allows a remote attacker to deliver a crafted HTML page that may trick users by rendering a counterfeit user interface. The vulnerability is classified as CWE-451 and could enable deception of users into interacting with a non‑legitimate UI.

Affected Systems

Devices running Google Chrome for iOS versions before 151.0.7922.72 are susceptible. The flaw exists only in those builds until the patched release is installed.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web page hosted by an adversary that a user opens on an affected device; remote exploitation requires only the presentation of a malicious page.

Generated by OpenCVE AI on August 3, 2026 at 11:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome for iOS to version 151.0.7922.72 or later, which includes the UI‑spoofing fix.
  • Avoid interacting with unfamiliar or suspicious web pages and exercise caution when following links from untrusted sources.
  • Enable automatic software updates on your device so Chrome receives security patches promptly.

Generated by OpenCVE AI on August 3, 2026 at 11:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Mon, 03 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing in Chrome for iOS Before Version 151.0.7922.72

Thu, 30 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T19:19:29.040Z

Reserved: 2026-07-27T23:35:09.409Z

Link: CVE-2026-17874

cve-icon Vulnrichment

Updated: 2026-07-30T19:19:24.550Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:51.330

Modified: 2026-08-03T19:06:06.763

Link: CVE-2026-17874

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:00:16Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information