CVE-2026-18003 is a UI spoofing vulnerability in Google Chrome on iOS before version 151.0.7922.72. It arises from an inappropriate implementation in the browser that allows a remote attacker to craft HTML content that can spoof the user interface, potentially misleading users. The vulnerability does not impact confidentiality or availability but affects integrity by misleading users. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No known exploits are currently reported. The vendor advisory link provided does not explicitly confirm patch status, but the affected version indicates that version 151.0.7922.72 or later is not vulnerable.

The vulnerability allows remote attackers to perform UI spoofing, which can mislead users into believing they are interacting with legitimate browser UI elements when they are not. This can potentially facilitate phishing or social engineering attacks but does not directly compromise confidentiality or availability. The impact is limited to integrity with a low severity rating by Chromium but a medium CVSS score overall.

Users should update Google Chrome for iOS to version 151.0.7922.72 or later to mitigate this vulnerability. Since the affected version is prior to 151.0.7922.72, applying this update addresses the issue. No additional mitigation steps are indicated by the vendor advisory. Monitor official Google Chrome release notes for confirmation of patch status.