CVE-2026-17849 is a medium severity vulnerability in Google Chrome for iOS before version 151.0.7922.72. It involves an inappropriate implementation that enables a remote attacker to spoof the Omnibox (URL bar) contents by leveraging malicious network traffic. This could mislead users about the website they are visiting, impacting the integrity of the browser's user interface. The vulnerability is identified as CWE-451 (Incorrect Expression of URL in the UI). No known exploits in the wild have been reported. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, but limited integrity impact.

The vulnerability allows an attacker to spoof the URL displayed in the Omnibox, potentially deceiving users into believing they are visiting a legitimate site when they are not. This can facilitate phishing or other social engineering attacks by undermining user trust in the browser's URL display. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

A fix is available in Google Chrome for iOS version 151.0.7922.72 and later. Users and administrators should update affected Chrome for iOS installations to version 151.0.7922.72 or newer to remediate this vulnerability. No additional mitigations are specified.