CVE-2026-17782 is an incorrect security UI vulnerability in Google Chrome on iOS versions before 151.0.7922.72. It enables a remote attacker to craft a malicious HTML page that spoofs the Omnibox, potentially misleading users about the true destination URL. This spoofing could facilitate phishing or other social engineering attacks by presenting a falsified URL in the browser's address bar. The vulnerability is specific to Chrome on iOS and does not have a CVSS score assigned. No known exploits are reported in the wild.

The vulnerability allows an attacker to spoof the URL displayed in the Omnibox, which may deceive users into trusting a malicious site. This can increase the risk of phishing attacks or other user-targeted social engineering exploits. There is no indication of direct code execution or data compromise from this vulnerability alone.

A fix is available in Google Chrome for iOS version 151.0.7922.72 and later. Users and administrators should update affected Chrome for iOS installations to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.