CVE-2026-13912: Chrome iOS UI Spoofing via Safe Browsing Flaw

Technical summary

CVE-2026-13912 stems from an inappropriate implementation in Chrome's Safe Browsing module on iOS. The vulnerability allows UI spoofing via crafted HTML, classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The Safe Browsing engine, which is designed to warn users about dangerous sites and downloads, fails to properly isolate or authenticate the display of its warnings and prompts. This permits a remote, unauthenticated attacker to construct a webpage that renders fake browser UI elements—such as phishing warnings, permission dialogs, or credential prompts—that appear authentic to the user. The attack surface is the rendering engine's treatment of HTML content in relation to native UI components. The CVSS v3.1 score of 4.3 (Medium) reflects the requirement for user interaction and the limited scope of impact (integrity only; no confidentiality or availability compromise).

Business impact

For organizations with iOS-using employees or customers, this vulnerability creates a social engineering vector. Attackers can use spoofed UI to convince users to bypass security measures, share sensitive data, or install malware. Financial services, healthcare, and government agencies are particularly at risk because their users are frequent targets of phishing campaigns that could be enhanced with convincing fake browser dialogs. While the direct impact is limited to integrity (the attacker cannot steal data directly through this flaw alone), the secondary effects—credential theft, malware installation, unauthorized transactions—can be severe. End-user awareness and timely patching are critical mitigations.

Affected systems

Google Chrome on iOS running versions prior to 150.0.7871.47 are affected. iOS-based devices (iPhone, iPad) using vulnerable Chrome builds are at risk. Android and desktop Chrome versions are not affected by this specific flaw. Users who rely on Chrome as their primary browser on iOS should prioritize patching. This vulnerability does not affect Safari or other iOS browsers, only the Chrome iOS application.

Exploitability

Exploitability is straightforward from a technical standpoint: the attacker only needs to host a malicious webpage and trick a user into visiting it. No authentication, special privileges, or complex setup is required on the attacker's side. Network access is unrestricted (AV:N). However, the attack depends entirely on user action—the victim must interact with the page or the spoofed UI element. The vulnerability is not remotely exploitable without social engineering. Given that phishing campaigns routinely achieve high click-through rates, this should be considered practically exploitable in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, suggesting no evidence of active exploitation at the time of publication, but this does not diminish the risk.

Remediation

Immediate action: Update Chrome on iOS to version 150.0.7871.47 or later. This patch corrects the Safe Browsing implementation to properly isolate UI elements and prevent spoofing. Users should enable automatic app updates in the Apple App Store settings to reduce the window of vulnerability. Organizations managing iOS devices via MDM should deploy the patched Chrome version to all managed endpoints. As an interim measure, consider disabling Chrome on supervised iOS devices or restricting it to internal, trusted sites only, though this may not be practical for many organizations. User education on recognizing spoofed browser UI is valuable but should not be relied upon as the sole control.

Patch guidance

Verify that Chrome on affected iOS devices is updated to version 150.0.7871.47 or later by checking Settings > About Chrome in the app. For MDM-managed devices, deploy the update through your mobile device management platform and verify installation across your fleet. Google typically releases iOS patches through the App Store, so confirm that your device or managed fleet has received the update from Apple's distribution channel. There is no workaround or configuration change that addresses this vulnerability; patching is the only remedy.

Detection guidance

At the endpoint level, verify Chrome version through the app's settings. For organizations with MDM, use inventory reports to identify devices running Chrome versions prior to 150.0.7871.47 and flag them for immediate patching. Network-based detection is limited because the attack relies on user behavior and spoofed UI rendering, which occurs client-side. Security teams should monitor for phishing campaigns that specifically target iOS users or mention browser warnings, as these may be attempts to exploit this flaw. Behavioral signals—users reporting unexpected browser dialogs or warnings—should be investigated. Endpoint Detection and Response (EDR) solutions on iOS are limited, so patching verification remains the primary control.

Why prioritize this

Although the CVSS score is moderate (4.3), the practical risk is elevated due to the social engineering component and the prevalence of phishing attacks targeting financial and government users. The ease of exploitation (a simple malicious webpage) combined with broad user exposure (iOS is ubiquitous) and the potential for secondary harm (credential theft, malware) justifies priority remediation. The vulnerability does not appear in the KEV catalog, but absence from KEV does not equate to low risk. Organizations should treat this as a priority patch for all iOS users.

Risk score, explained

The CVSS 4.3 Medium severity reflects a network-based attack with low complexity and no privilege escalation, but requiring user interaction. The impact is limited to integrity (UI spoofing), with no direct confidentiality or availability loss. However, this score does not fully capture the secondary business risk: spoofed UI can be a stepping stone to credential theft or malware deployment. Organizations handling sensitive data should weight the secondary risk heavily and consider this a higher priority than the CVSS score alone suggests.

Frequently asked questions