CVE-2026-17913 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a user interface spoofing issue affecting Google Chrome for iOS versions prior to 151.0.7922.72, classified as a low severity chromium security flaw. The vulnerability stems from an inadequate implementation in how the mobile browser handles crafted HTML content that can manipulate the visual presentation of web pages. Attackers can exploit this weakness by constructing malicious web pages that deceive users into believing they are interacting with legitimate interfaces while actually executing unauthorized actions.
The technical nature of this flaw involves the improper rendering of user interface elements within the Chrome for iOS environment, specifically related to how the browser processes and displays HTML content that attempts to mimic legitimate interface components. This type of vulnerability falls under the broader category of UI redressing attacks, where attackers manipulate the visual appearance of web interfaces to trick users into performing unintended actions. The issue is particularly concerning in mobile environments where screen real estate is limited and users may be more susceptible to visual deception.
From an operational perspective, this vulnerability enables remote attackers to conduct phishing-like attacks that can lead to credential theft or unauthorized transactions. Users may be deceived into entering sensitive information on spoofed forms or clicking on malicious links that appear to originate from trusted websites. The low severity classification suggests that while the attack vector is present, it does not typically result in complete system compromise or data exfiltration. However, the potential for user deception remains significant, particularly when combined with social engineering techniques.
The vulnerability aligns with CWE-611 (Improper Restriction of XML External Entity Reference) and relates to ATT&CK technique T1531 (Account Access Removal) through its ability to manipulate user interface elements that could lead to unauthorized access. Organizations should consider this as part of their broader mobile security posture assessment, particularly for environments where iOS devices are prevalent. The recommended mitigation involves updating Chrome for iOS to version 151.0.7922.72 or later, which includes patches addressing the UI spoofing implementation flaws. Security teams should also implement user awareness training to recognize potentially deceptive interface elements and consider network-level monitoring to detect suspicious web traffic patterns associated with known malicious domains.