CVE-2026-13902: Chrome iOS UI Spoofing Vulnerability – CVSS 4.3 Patch Guide

Technical summary

CVE-2026-13902 stems from an inappropriate implementation in Chrome's iOS rendering layer that fails to properly sandbox or validate the boundaries between web content and browser UI elements. The vulnerability resides in how the browser handles crafted HTML pages, allowing scripts or markup to manipulate the visual presentation of UI components. The flaw is classified under CWE-451 (User Interface Rendition of Untrusted Data), indicating a failure to securely present untrusted content without risking confusion with legitimate interface elements. The attack vector is network-based with low attack complexity; it requires user interaction (visiting a malicious page) but no elevated privileges. The impact is limited to integrity—no confidentiality loss or availability impact—reflecting that the attacker can deceive but not directly steal data or crash the browser.

Business impact

UI spoofing vulnerabilities undermine user confidence in browser security indicators. Users may not distinguish between legitimate browser warnings and attacker-controlled overlays, increasing susceptibility to credential harvesting, malware distribution, or payment fraud schemes. For organizations with BYOD policies or iOS-heavy workforces, this creates a vector for credential compromise without requiring network interception. The medium severity and need for user interaction mean the risk is real but not critical; however, combined with social engineering campaigns, the attack surface widens. A user visiting a compromised or attacker-controlled site could be deceived into entering credentials or approving actions they would not otherwise permit.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are vulnerable. The flaw also carries implications for Apple iPhone OS due to Chrome's dependency on iOS security frameworks and rendering APIs. Notably, this is an iOS-specific issue; the vulnerability does not affect Chrome on Android, Windows, macOS, or Linux unless they contain identical code paths—verification with vendor advisories is necessary for non-iOS platforms. Organizations with iOS users should prioritize updates to this specific Chrome version or later.

Exploitability

Exploitation is straightforward in concept but depends on user interaction. An attacker must craft HTML designed to spoof UI elements—for example, a fake login prompt or address bar—and host it on a web server or inject it into a compromised legitimate site. The low attack complexity means the attacker does not need to chain multiple vulnerabilities or exploit timing race conditions. No authentication or special network position is required. However, the attack's success hinges on social engineering; users must be convinced to interact with the spoofed content. This is not an in-the-wild worm or zero-click vulnerability, so the practical risk depends on campaign sophistication and target awareness.

Remediation

Users must update Google Chrome for iOS to version 150.0.7871.47 or later. This is a straightforward patch deployment with no known workarounds short of avoiding Chrome on iOS entirely (not practical for most). Organizations should enforce auto-update policies for Chrome on iOS via MDM or MAM controls, setting minimum version requirements. Since the issue is in the browser itself rather than the OS, updating iOS alone will not resolve the vulnerability; the Chrome app must be updated independently.

Patch guidance

Verify that all managed and unmanaged iOS devices running Chrome have received the update to version 150.0.7871.47 or later. If using Apple Business Manager or MDM solutions, configure Chrome update enforcement to mandatory and block older versions from running. For BYOD programs, distribute security advisories to users and provide direct links to the App Store. Test the update in a non-production environment first to confirm compatibility with corporate web applications, though this vulnerability's fix is unlikely to cause regression. Timeline: deploy within 30 days for MEDIUM severity issues affecting iOS, as iOS users may have weaker endpoint isolation than corporate desktops.

Detection guidance

Monitor Chrome version inventory via MDM reporting to identify devices running versions prior to 150.0.7871.47. If telemetry or endpoint detection tools are available, flag suspicious HTML rendering patterns or user-agent anomalies associated with iOS Chrome clients. On the network side, intrusion detection systems can flag attempts to serve crafted HTML with known spoofing payloads, though signature quality will vary. Incident response should investigate any reports of users being tricked into credential entry or permission grants on iOS Chrome, as these may indicate attempted or successful exploitation. No silver-bullet behavioral signal uniquely identifies this attack; focus remains on version coverage.

Why prioritize this

CVE-2026-13902 warrants prioritization due to its direct attack on user trust and its applicability to any iOS user—employees, contractors, or guests on corporate networks. Though CVSS 4.3 is moderate, the attack requires only social engineering and a webpage, making it accessible to a broad threat actor population. Organizations that rely on Chrome for iOS should treat this as a standard patch cycle item for timely remediation. The lack of KEV designation indicates no active in-the-wild exploitation detected at time of publication, but this does not guarantee the vulnerability will remain unexploited; UI spoofing flaws are well-understood and relatively easy to weaponize.

Risk score, explained

The CVSS v3.1 score of 4.3 (MEDIUM) reflects the network-based attack vector, low complexity, and requirement for user interaction, balanced against the limited impact scope (integrity only, no confidentiality or availability loss). The score appropriately de-prioritizes this relative to critical code execution flaws but maintains its relevance for phishing and social engineering campaigns. Chromium's internal severity assessment (also Medium) aligns with this scoring.

Frequently asked questions