CVE-2026-17849: Chrome for iOS URL Spoofing Vulnerability

CVE-2026-17849 Overview

CVE-2026-17849 is an Omnibox (URL bar) spoofing vulnerability in Google Chrome for iOS versions prior to 151.0.7922.72. The flaw stems from an inappropriate implementation in the Chrome for iOS component. A remote attacker can send malicious network traffic to spoof the contents displayed in the Omnibox. Chromium rates the security severity as Medium.

Successful exploitation misleads users about the origin of the page they are viewing. This creates conditions favorable to phishing and credential theft attacks. Google addressed the issue in Chrome for iOS 151.0.7922.72.

Critical Impact
Attackers can misrepresent the URL displayed in Chrome for iOS, enabling convincing phishing pages that appear to originate from trusted domains.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
Chromium-based browser components on iOS relying on the affected Omnibox logic
iOS devices running vulnerable Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17849 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17849

Vulnerability Analysis

The vulnerability resides in the Chrome for iOS Omnibox implementation. The Omnibox is the combined address and search bar responsible for displaying the current page's URL to the user. An inappropriate implementation in how Chrome for iOS updates or renders Omnibox contents allows a remote attacker to manipulate the displayed URL.

The attack requires only that a user visit a malicious page or interact with attacker-controlled network traffic. No authentication or additional user interaction beyond normal browsing is needed. Because the Omnibox is the primary trust signal iOS users rely on to verify site identity, spoofing it directly undermines phishing defenses.

Related Chromium bug tracker details are available in the Chromium Issue Tracker Entry.

Root Cause

The root cause is an inappropriate implementation in Chrome for iOS that permits network-driven manipulation of the Omnibox contents. The browser fails to correctly synchronize the displayed URL with the actual origin of the loaded content under certain conditions. Google has not publicly disclosed the low-level mechanism.

Attack Vector

An attacker delivers crafted network traffic, typically by luring a victim to a controlled URL or intercepting navigation. The attacker triggers a condition in which Chrome for iOS displays a URL different from the origin actually being rendered. The user sees a trusted-looking URL while interacting with attacker-controlled content.

See the Google Chrome Release Update for the vendor release notes.

Detection Methods for CVE-2026-17849

Indicators of Compromise

Chrome for iOS builds with version numbers below 151.0.7922.72 present on managed devices
Users reporting mismatches between the URL shown in the Omnibox and the visible page content
Phishing reports referencing legitimate-looking URLs served from suspicious hosting infrastructure

Detection Strategies

Inventory iOS mobile fleets and identify Chrome installations that have not been updated to 151.0.7922.72 or later
Monitor web proxy and DNS telemetry for traffic to newly registered domains impersonating high-value brands
Correlate user-reported phishing incidents with Chrome for iOS user-agent strings on mobile endpoints

Monitoring Recommendations

Enable mobile threat defense telemetry to track browser versions across managed iOS devices
Alert on unusual credential submission patterns originating from mobile browsers
Track Chrome release channels and flag devices running outdated builds beyond a defined threshold

How to Mitigate CVE-2026-17849

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push updated Chrome builds via mobile device management (MDM) policies where available
Communicate the risk of URL spoofing to users and remind them to verify site identity through multiple signals

Patch Information

Google released the fix in Chrome for iOS 151.0.7922.72. Users should install the update from the App Store. Enterprise administrators should confirm deployment through their MDM inventory. Refer to the Google Chrome Release Update for release details.

Workarounds

Use an alternate iOS browser that is not affected until Chrome can be updated
Restrict access to sensitive corporate applications from mobile browsers pending patch deployment
Enforce phishing-resistant authentication such as FIDO2 security keys to reduce impact of credential spoofing

bash

# Verify Chrome for iOS version via MDM query (example pseudocode)
mdm query --app com.google.chrome.ios --field CFBundleShortVersionString
# Expected minimum patched version: 151.0.7922.72