CVE-2026-17965: Chrome for iOS XSS Vulnerability

CVE-2026-17965 Overview

CVE-2026-17965 is a security UI flaw in Google Chrome for iOS. Versions prior to 151.0.7922.72 incorrectly render security UI elements, allowing a remote attacker to spoof interface components through a crafted HTML page. Chromium classifies this issue at Low security severity.

The vulnerability falls under User Interface Confusion, a class of flaws where the browser presents misleading trust indicators to users. Attackers can leverage this weakness to conduct phishing campaigns by mimicking legitimate site chrome, address bar content, or security prompts inside Chrome on iOS.

Critical Impact
Attackers can craft HTML pages that spoof Chrome for iOS security UI, enabling phishing and credential theft against users who trust the displayed interface.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
End-user browsing sessions accessing attacker-controlled HTML content

Discovery Timeline

2026-07-30 - CVE-2026-17965 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17965

Vulnerability Analysis

The flaw resides in how Chrome for iOS renders security UI when processing crafted HTML content. The browser fails to correctly maintain integrity between the address bar, security indicators, and page content. A remote attacker delivering malicious HTML can therefore influence what the user perceives as trusted browser chrome.

UI spoofing vulnerabilities in mobile browsers carry heightened impact. Screen real estate constraints on iOS reduce the visibility of URL bars and trust indicators, making inconsistencies harder for users to detect. Attackers commonly use these flaws to layer fake login prompts or fabricated HTTPS lock icons over otherwise unremarkable pages.

Root Cause

The root cause is incorrect handling of security UI elements when the renderer processes attacker-controlled HTML. Chrome for iOS does not preserve the required boundary between content-controlled surfaces and browser-controlled surfaces. This mismatch enables the crafted page to influence what would normally be trusted UI.

Attack Vector

Exploitation requires a user to visit an attacker-controlled or compromised web page in a vulnerable Chrome for iOS build. The crafted HTML manipulates rendering behavior to produce misleading security cues. No authentication or elevated privileges are required. Full technical discussion is available in the Chromium Issue Tracker Discussion.

No verified proof-of-concept code is publicly available. See the Google Chrome Desktop Update advisory for release-channel notes covering the fix.

Detection Methods for CVE-2026-17965

Indicators of Compromise

Users reporting login prompts or security dialogs that appear inside web content rather than as native iOS system prompts
Outbound traffic from mobile devices to newly registered domains that mimic legitimate brands
Credential submissions from iOS Chrome sessions to domains inconsistent with the impersonated brand

Detection Strategies

Inventory Chrome for iOS versions across managed mobile devices and flag builds earlier than 151.0.7922.72
Monitor mobile web proxy logs for pages containing overlay elements that mimic browser chrome, address bars, or lock icons
Correlate phishing report intake with Chrome for iOS user agents to identify targeted campaigns

Monitoring Recommendations

Enable MDM reporting of installed browser versions on all corporate iOS devices
Route iOS mobile traffic through secure web gateways capable of blocking known phishing infrastructure
Track user-reported phishing incidents that reference Chrome for iOS to surface active exploitation attempts

How to Mitigate CVE-2026-17965

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push mandatory browser updates via Mobile Device Management (MDM) policy for managed fleets
Reinforce user awareness that legitimate iOS credential prompts render as native system dialogs, not inside web pages

Patch Information

Google addressed CVE-2026-17965 in Chrome for iOS 151.0.7922.72. Users should install the update directly from the App Store. Release details are documented in the Google Chrome Desktop Update blog entry, and additional context appears in the Chromium Issue Tracker Discussion.

Workarounds

Restrict Chrome for iOS usage to trusted sites until the update is applied
Enforce phishing-resistant authentication such as passkeys or hardware tokens to reduce impact of credential theft
Deploy a mobile secure web gateway that blocks known phishing and typosquat domains

bash

# Configuration example
# Verify Chrome for iOS version compliance via MDM query
# Target: Google Chrome iOS >= 151.0.7922.72
mdm query --app com.google.chrome.ios --field CFBundleShortVersionString
mdm policy set --app com.google.chrome.ios --min-version 151.0.7922.72 --action force-update