CVE-2026-17782: Chrome for iOS XSS Vulnerability

CVE-2026-17782 Overview

CVE-2026-17782 is an incorrect security UI vulnerability affecting Google Chrome for iOS prior to version 151.0.7922.72. A remote attacker can spoof the contents of the Omnibox (URL bar) by delivering a crafted HTML page to a victim. Chromium classifies the security severity as Medium.

The flaw enables address-bar spoofing, which undermines the primary trust indicator users rely on to verify site identity. This class of issue is commonly abused in phishing campaigns to impersonate legitimate domains.

Critical Impact
Attackers can render a misleading URL in the Chrome for iOS Omnibox, enabling convincing phishing and credential-theft scenarios against mobile users.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Users interacting with attacker-controlled HTML content in Chrome for iOS

Discovery Timeline

2026-07-30 - CVE-2026-17782 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17782

Vulnerability Analysis

The vulnerability resides in the security UI logic of Chrome for iOS, specifically the code that determines what URL is displayed in the Omnibox. A crafted HTML page can trigger conditions that cause the browser to display a URL that does not correspond to the origin actually rendering content in the tab.

Address bar spoofing defeats a core browser security guarantee. Users depend on the Omnibox to identify the true origin of the page they are viewing. When this indicator can be manipulated, phishing pages become significantly harder to detect, even for security-aware users.

Because Chrome for iOS is built on the WebKit engine required by Apple's platform, the affected code path is in Chrome's UI layer rather than in the rendering engine. The fix ships in Chrome for iOS 151.0.7922.72 and later.

Root Cause

The root cause is improper handling of navigation state or URL presentation within Chrome for iOS UI code. The Omnibox update logic did not correctly reflect the actual security context of the loaded document, allowing a crafted page to influence the displayed URL. See the Chromium Issue Tracker Entry for additional detail once restrictions are lifted.

Attack Vector

An attacker hosts a crafted HTML page and lures the target to visit it in Chrome for iOS. The page manipulates navigation or window state to cause the Omnibox to render a URL that differs from the true origin. The victim then interacts with attacker content while trusting a spoofed identity indicator, typically resulting in credential entry on what appears to be a legitimate domain.

No verified exploit code is publicly available for CVE-2026-17782. See the Google Chrome release notes for vendor detail.

Detection Methods for CVE-2026-17782

Indicators of Compromise

Chrome for iOS clients reporting a version earlier than 151.0.7922.72 in mobile device management inventory
User reports of Omnibox URLs that do not match observed page content or unexpected redirects during navigation
Phishing pages referrer-linked from unfamiliar HTML hosting infrastructure targeting iOS Chrome user agents

Detection Strategies

Inventory Chrome for iOS versions across managed mobile fleets and flag installs below 151.0.7922.72
Correlate web proxy or DNS logs with newly registered domains delivering HTML content to iOS Chrome user agents
Monitor authentication systems for credential submissions from mobile sessions immediately following visits to low-reputation domains

Monitoring Recommendations

Enable phishing and malicious URL categorization on mobile web filtering solutions
Track user-reported phishing incidents originating on iOS devices for URL-bar inconsistency reports
Review mobile threat defense telemetry for browser version compliance and risky navigation events

How to Mitigate CVE-2026-17782

Immediate Actions Required

Update Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push mandatory browser updates through mobile device management for enrolled iOS devices
Remind users to verify domain names carefully before entering credentials on mobile browsers

Patch Information

Google released the fix in Chrome for iOS 151.0.7922.72. Refer to the Google Chrome Desktop Update advisory and the Chromium Issue Tracker Entry for release detail. Chrome updates on iOS are distributed through the Apple App Store.

Workarounds

Use an alternative iOS browser configured with strict phishing protection until the update is applied
Access sensitive services such as banking and corporate SSO only through bookmarked URLs rather than links
Enforce multi-factor authentication so that spoofed credential capture alone does not yield account takeover

bash

# Verify Chrome for iOS version compliance via MDM query
# Target: Google Chrome iOS >= 151.0.7922.72
mdm query --app com.google.chrome.ios --field CFBundleShortVersionString