PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17965 Google CVE debrief

CVE-2026-17965 is a Medium severity vulnerability in Google Chrome for iOS prior to version 151.0.7922.72. It allows remote attackers to perform UI spoofing via crafted HTML pages. This vulnerability affects Google Chrome on iOS deployments, requiring defenders to assess exposure and prioritize updating to version 151.0.7922.72 or later. The vulnerability's impact is limited to UI spoofing, with no reported exploitation or additional impact details. Defenders should verify and update Google Chrome on iOS to prevent potential UI spoofing, and users should exercise caution when interacting with HTML pages from untrusted sources. Official sources, including the CVE Program record and

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing Google Chrome on iOS deployments should assess exposure and prioritize updating to version 151.0.7922.72 or later. Users of Google Chrome on iOS should be aware of potential UI spoofing risks and exercise caution when interacting with HTML pages from untrusted sources.

Why it matters

CVE-2026-17965 is a Medium severity vulnerability in Google Chrome for iOS that allows remote attackers to perform UI spoofing. Defenders should prioritize verifying and updating Google Chrome on iOS to version 151.0.7922.72 or later. The corpus does not establish specific exploitation or impact details, requiring verification from official sources.

  • Defenders must verify and update Google Chrome on iOS to prevent potential UI spoofing
  • Users may be susceptible to UI spoofing attacks if using vulnerable versions of Google Chrome on iOS
  • Defensive priority is medium due to the potential for UI spoofing and the availability of a patch

Technical summary

The vulnerability, CVE-2026-17965, is a Medium severity issue in Google Chrome for iOS prior to version 151.0.7922.72. It allows remote attackers to perform UI spoofing via crafted HTML pages. The CVSS score is 4.3, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome on iOS to version 151.0.7922.72 or later, and ensure that users are aware of potential UI spoofing risks.

Recommended defensive actions

  • Verify and update Google Chrome on iOS to version 151.0.7922.72 or later
  • Ensure users are aware of potential UI spoofing risks
  • Monitor for suspicious activity and implement compensating controls as needed

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its severity, and affected versions. However, the corpus does not establish specific exploitation or impact details, requiring verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17965 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17965

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17965 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17965

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.