The vulnerability CVE-2026-17849 affects Google Chrome on iOS versions before 151.0.7922.72. It involves an inappropriate implementation that enables a remote attacker to spoof the Omnibox content, which is the URL bar, by leveraging malicious network traffic. This could cause users to be misled about the website they are visiting. The issue is classified with medium severity by Chromium security. No CVSS score is available, and there are no known exploits in the wild. The vulnerability is fixed in version 151.0.7922.72.

An attacker can remotely spoof the URL displayed in the Omnibox of Chrome for iOS, potentially deceiving users about the legitimacy of the website they are visiting. This can facilitate phishing or other social engineering attacks by making malicious sites appear trustworthy. There are no reports of active exploitation in the wild.

Users should update Google Chrome on iOS to version 151.0.7922.72 or later to remediate this vulnerability. Since this is a client-side application vulnerability, applying the official update is the recommended and effective mitigation. No additional vendor advisory content is provided, so patch status is inferred from the version information.