CVE-2026-17874: Chrome for iOS XSS Vulnerability

CVE-2026-17874 Overview

CVE-2026-17874 is a user interface (UI) spoofing vulnerability in Google Chrome for iOS. The flaw stems from an inappropriate implementation in Chrome for iOS versions prior to 151.0.7922.72. A remote attacker can exploit this weakness by serving a crafted HTML page to a targeted user. Successful exploitation enables the attacker to manipulate browser UI elements and deceive users about the origin or trustworthiness of displayed content. Chromium security engineers rated the underlying issue as Medium severity. The vulnerability aligns with user interface confusion patterns that facilitate phishing, credential harvesting, and social engineering attacks.

Critical Impact
A remote attacker can spoof browser UI elements through a crafted HTML page, enabling phishing and social engineering attacks against Chrome for iOS users.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Applications embedding Chrome for iOS components

Discovery Timeline

2026-07-30 - CVE-2026-17874 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17874

Vulnerability Analysis

CVE-2026-17874 is categorized as a User Interface Confusion vulnerability. The defect resides in Chrome for iOS rendering and UI logic. Attackers exploit inconsistencies between what the browser renders and what the address bar, security indicators, or overlay elements report to the user. A crafted HTML page can influence how Chrome for iOS composes trust-relevant UI, allowing an attacker-controlled page to appear as legitimate content from another origin.

UI spoofing weaknesses in mobile browsers are particularly effective because screen space is limited. Users rely heavily on the address bar and TLS indicators to make trust decisions. Manipulating these controls raises the success rate of phishing pages, fake login prompts, and fraudulent transaction interfaces.

Root Cause

The root cause is an inappropriate implementation within Chrome for iOS UI handling logic. The browser fails to properly reconcile page-controlled content with browser chrome under specific rendering conditions. Details of the exact code path are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires a remote attacker to lure a Chrome for iOS user to a malicious website. The attacker crafts HTML content that triggers the UI spoofing condition. No authentication is required, and the attack proceeds over standard web navigation. The attacker cannot execute code but can visually deceive the victim into interacting with attacker-controlled elements as though they were trusted browser UI.

No public exploit code has been released. Refer to the Chrome Desktop Update Announcement and the Chromium issue tracker for further technical context.

Detection Methods for CVE-2026-17874

Indicators of Compromise

Chrome for iOS clients reporting versions below 151.0.7922.72 in user-agent telemetry.
Users reporting mismatched address bar content, unexpected overlays, or credential prompts on unfamiliar domains.
Web proxy logs showing navigation to newly registered domains hosting login forms that impersonate corporate services.

Detection Strategies

Inventory Chrome for iOS versions across managed mobile devices via MDM reporting and flag builds prior to 151.0.7922.72.
Monitor web gateway telemetry for suspicious HTML payloads referencing brand-impersonation keywords or spoofed login flows.
Correlate user-reported phishing incidents with mobile browser user-agent strings to identify targeted campaigns.

Monitoring Recommendations

Enable browser telemetry ingestion into a centralized logging platform for version and navigation visibility.
Track DNS and TLS logs for lookalike domains that align with known phishing infrastructure.
Alert on repeated user submissions of credentials to newly observed domains from iOS devices.

How to Mitigate CVE-2026-17874

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later on all managed and unmanaged iOS devices.
Push the update through mobile device management (MDM) policies to enforce rapid remediation across the fleet.
Communicate the vulnerability to end users and reinforce phishing awareness for mobile browsing sessions.

Patch Information

Google released the fix in Chrome for iOS 151.0.7922.72. Users should install the update through the Apple App Store. Additional release information is available in the Chrome Desktop Update Announcement and tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict access to untrusted websites on iOS devices using network-layer web filtering.
Enforce use of alternative, patched browsers on iOS until Chrome updates are applied.
Train users to verify domain names manually and to avoid entering credentials when browser UI appears inconsistent.

bash

# Verify Chrome for iOS version via MDM query and enforce minimum build
# Example: JSS/Jamf smart group criteria
Application Bundle ID: com.google.chrome.ios
Application Version: less than 151.0.7922.72