CVE-2026-17849 Google CVE debrief

Who should care

Users of Google Chrome for iOS, particularly those who access the browser on untrusted networks or with sensitive information, should be aware of this vulnerability and take steps to mitigate it. This includes IT administrators responsible for Chrome for iOS deployments, security teams monitoring for potential threats, and individual users who may be exposed to malicious network traffic.

Technical summary

The CVE-2026-17849 vulnerability is caused by an inappropriate implementation in Google Chrome for iOS, allowing remote attackers to spoof the Omnibox via malicious network traffic. The issue has a CVSS score of 4.3 and Medium severity. The vulnerability was reported in Google Chrome for iOS prior to version 151.0.7922.72. Users should apply the latest Chrome for iOS update to address the vulnerability. Limited information is available on the exact scope of affected systems and user interaction requirements.

Defensive priority

Medium severity vulnerability in Google Chrome for iOS, allowing remote attackers to spoof the Omnibox via malicious network traffic.

Recommended defensive actions

• Apply the latest Google Chrome for iOS update (151.0.7922.72 or later) to address the vulnerability.
• Monitor network traffic for potential malicious activity.
• Verify that Chrome for iOS is properly configured and up-to-date on all devices.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-17849 vulnerability was reported in Google Chrome for iOS, with a CVSS score of 4.3 and Medium severity. The issue allows remote attackers to spoof the Omnibox via malicious network traffic. Limited information is available on the exact scope of affected systems and user interaction requirements. Evidence is limited to CVE and NVD details. Defenders should verify Chrome for iOS version 151.0.7922.72 or later is deployed, and monitor for suspicious network traffic.

Official resources