CVE-2026-17838: Chrome for iOS Domain Spoofing Vulnerability

CVE-2026-17838 Overview

CVE-2026-17838 affects Google Chrome for iOS in versions prior to 151.0.7922.72. The vulnerability stems from incorrect security UI handling in the browser. A remote attacker can perform domain spoofing by delivering a crafted HTML page to a target user. Chromium classifies the security severity as Medium.

The flaw undermines the trust indicators users rely on to verify the identity of a website. Successful exploitation enables convincing phishing attacks and credential theft against iOS Chrome users.

Critical Impact
A remote attacker can spoof the displayed domain in Chrome for iOS, deceiving users into trusting attacker-controlled content presented as a legitimate website.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Users navigating to attacker-controlled or compromised HTML pages

Discovery Timeline

2026-07-30 - CVE-2026-17838 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17838

Vulnerability Analysis

The issue is a User Interface Confusion class vulnerability in Chrome for iOS. Chrome's address bar and related security indicators are responsible for communicating the true origin of the loaded content. When these indicators render incorrectly, users cannot distinguish an attacker-controlled page from a legitimate site.

The advisory categorizes the flaw as "Incorrect security UI" affecting the Chrome for iOS component. Google released a fix in Chrome 151.0.7922.72. Detailed technical information is tracked in the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.

Root Cause

The root cause is improper rendering or state handling of Chrome's URL and origin indicators on iOS. The security UI presents a domain string that does not accurately reflect the origin of the content being displayed. Full implementation details are restricted while the Chromium ticket remains embargoed.

Attack Vector

Exploitation requires a remote attacker to lure a victim to a crafted HTML page. The attacker uses HTML or navigation primitives to manipulate Chrome for iOS into displaying a domain in the address bar that differs from the actual origin serving the content. This misrepresentation supports phishing campaigns targeting login pages, banking portals, and enterprise SaaS applications.

The vulnerability does not grant code execution. Its value to attackers lies in bypassing user judgment during phishing operations. See the security advisory for technical details.

Detection Methods for CVE-2026-17838

Indicators of Compromise

Users reporting login prompts or forms on domains that differ from the address bar contents
Web traffic from iOS devices to newly registered domains hosting cloned login pages
HTML pages served with unusual window.location, history.pushState, or navigation logic that manipulates URL display
Credential submissions from Chrome for iOS to attacker-controlled endpoints following a redirect chain

Detection Strategies

Inventory Chrome for iOS versions across managed mobile devices and flag any build older than 151.0.7922.72
Correlate mobile browser telemetry with DNS logs to identify visits to lookalike or newly registered domains
Monitor identity providers for authentication attempts originating from Chrome on iOS that follow suspicious referrer chains
Review phishing report queues for iOS-specific spoofing samples referencing this CVE

Monitoring Recommendations

Enable browser and mobile device management (MDM) reporting of installed Chrome versions
Ingest DNS, proxy, and identity provider logs into a centralized data lake for cross-source correlation
Alert on multi-factor authentication challenges from newly seen iOS user agents
Track user-submitted phishing reports and prioritize samples that render differently on iOS Chrome

How to Mitigate CVE-2026-17838

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push the updated build to managed iOS devices using MDM enforcement policies
Communicate the risk to end users and reinforce guidance to verify URLs before submitting credentials
Rotate credentials for any accounts suspected of interacting with spoofed pages

Patch Information

Google addressed CVE-2026-17838 in Chrome for iOS 151.0.7922.72. Update details are provided in the Google Chrome Update Announcement. Additional tracking information is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is deployed
Enforce phishing-resistant authentication such as FIDO2 or platform passkeys to reduce credential-theft impact
Route mobile browser traffic through a secure web gateway that blocks known phishing infrastructure
Train users to verify site identity through certificate details rather than the address bar alone

bash

# Example MDM configuration snippet to enforce minimum Chrome for iOS version
# Requires MDM support for managed app version policies
{
  "BundleID": "com.google.chrome.ios",
  "MinimumAppVersion": "151.0.7922.72",
  "EnforcementAction": "BlockLaunch"
}