Live › vulnerability › CVE-2026-121051
A UI flaw in the iOSWeb component of Google Chrome on iOS lets a crafted HTML page display a fake address bar. An attacker can use this to make a phishing page look like a trusted site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone using Google Chrome on iOS before version 157.0.8103.38. The sources describe a crafted HTML page as the trigger, so exposure comes from visiting an untrusted page. Desktop Chrome and other browsers are not mentioned.
No product ranges from the sources yet.
157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121051")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.