This vulnerability (CVE-2026-17849) affects Google Chrome on iOS versions before 151.0.7922.72. It is caused by an inappropriate implementation that enables remote attackers to spoof the Omnibox contents through malicious network traffic. The issue is classified under CWE-451 (Incorrect Expression of URL). The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. The vendor advisory is available but does not explicitly state patch availability or remediation instructions.

The vulnerability allows attackers to spoof the URL shown in the Omnibox of Chrome on iOS, potentially misleading users about the legitimacy of the website they are visiting. This impacts the integrity of the URL display but does not affect confidentiality or availability of data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes for updates addressing this issue. Until a fix is confirmed, exercise caution when interacting with URLs in Chrome on iOS and avoid clicking suspicious links.