CVE-2026-13907: Chrome iOS UI Spoofing Vulnerability – Patch Guidance

Technical summary

This vulnerability exists in Chrome's iOSWeb implementation and stems from an inappropriate implementation of UI handling on iOS. The flaw allows a remote, unauthenticated attacker to craft an HTML page that, when combined with specific user gestures, triggers UI spoofing—a form of visual deception where the rendered interface misrepresents the true state or origin of content. The vulnerability is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating the core issue involves misleading visual presentation rather than direct code execution. The attack vector is network-based with high complexity, and success depends entirely on user interaction.

Business impact

UI spoofing attacks typically target user trust and can facilitate phishing, credential theft, or social engineering campaigns. While this vulnerability cannot directly steal data or execute arbitrary code, it could be weaponized to convince users to take actions they would not otherwise take—such as entering credentials on a spoofed login form or accepting a malicious permission prompt that appears to come from a trusted source. Organizations should consider the reputational risk if users are tricked into compromising their own security through this vector.

Affected systems

This vulnerability affects Google Chrome on iOS (Apple iPhone OS) versions prior to 150.0.7871.47. The vulnerability is specific to the iOS platform and does not apply to Chrome on other operating systems. Any user running an outdated version of Chrome on an iPhone or iPad is potentially at risk.

Exploitability

Exploitation requires network access and user interaction—specifically, the attacker must craft a malicious HTML page and convince a user to visit it and perform specific UI gestures. There is no automatic exploitation, no zero-click trigger, and no requirement for the user to have elevated privileges. The attack complexity is rated as high, meaning successful exploitation demands particular circumstances or considerable user interaction. This is a targeted attack vector rather than a widespread, easily-triggered flaw. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been observed in the wild as of the publication date.

Remediation

Users should update Google Chrome on iOS to version 150.0.7871.47 or later. Apple's iOS update mechanism generally handles Chrome updates through the App Store; users should check for available updates and install them promptly. No workarounds are available, so patching is the only effective mitigation. Security teams managing iOS device fleets should prioritize distribution of the patched Chrome version.

Patch guidance

Verify that your Chrome on iOS has been updated to version 150.0.7871.47 or later by navigating to Chrome Settings > About Chrome, which will display the current version and initiate an automatic update check if needed. For organizations managing iOS devices via Mobile Device Management (MDM), ensure that your configuration mandates the minimum Chrome version to enforce compliance. Because iOS updates are delivered through the App Store, confirm that your device has App Store access and automatic app updates enabled, or manually trigger the update within the App Store app.

Detection guidance

Detection of exploitation after the fact is challenging because UI spoofing is a visual attack that does not leave obvious traces in system logs. However, security teams can monitor for suspicious patterns such as: unusual user behavior following visits to unfamiliar websites, spike in credential reset requests or account lockouts, or user reports of unexpected permission prompts. On the network level, look for users visiting suspicious or newly registered domains. Endpoint detection and response (EDR) tools may flag unusual browser behavior if the attack escalates beyond UI spoofing, but baseline detection at the browser level will require manual user reporting or behavioral analytics.

Why prioritize this

Despite its medium CVSS score, this vulnerability merits timely but not emergency patching. The attack requires user interaction and high complexity, and there is no evidence of active exploitation in the wild. However, it should be prioritized above non-critical issues because: (1) it targets a widely-used platform and browser, (2) UI spoofing can facilitate downstream attacks like credential theft, and (3) patches are readily available with no known deployment friction. This is a standard-priority patch for any organization with iOS users accessing sensitive services via Chrome.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a medium-severity vulnerability with several mitigating factors. The attack vector is network-based (AV:N), but the attack complexity is high (AC:H), meaning the attacker cannot reliably exploit it at scale. User interaction is required (UI:R), which further reduces the real-world attack surface. The scope is unchanged (S:U), meaning the vulnerability does not cross privilege boundaries. Integrity and availability are slightly impacted (I:L/A:L), but there is no confidentiality loss (C:N). The score appropriately reflects a UI-based threat that poses moderate risk primarily in targeted scenarios, not in mass exploitation campaigns.

Frequently asked questions