This vulnerability, identified as CVE-2026-17835, affects Google Chrome on iOS before version 151.0.7922.72. It stems from an inappropriate implementation that enables remote attackers to conduct UI spoofing attacks by crafting malicious HTML pages. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vulnerability is categorized under CWE-451 (XML External Entity (XXE) Injection or similar inappropriate implementation).

The impact is limited to UI spoofing, which can deceive users into interacting with malicious or misleading interface elements. This can lead to potential phishing or social engineering attacks but does not directly compromise confidentiality or availability of the system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory URL is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Users should update to version 151.0.7922.72 or later once confirmed. Until then, be cautious of untrusted HTML content and avoid interacting with suspicious links or pages.