CVE-2026-13916: Chrome iOS UI Spoofing Vulnerability – Patch Guide

Technical summary

This vulnerability stems from an inappropriate implementation in Chrome's iOS rendering engine that fails to properly enforce UI boundary restrictions. The flaw is categorized as CWE-451 (User Interface (UI) Misrepresentation of Critical Information), which describes failures to prevent untrusted content from mimicking system or application UI elements. An attacker can exploit this through a crafted HTML page to overlay or spoof browser UI components, undermining user trust in displayed information and potentially facilitating social engineering attacks. The vulnerability is network-accessible, requires no authentication, and only needs user interaction to trigger—the user must navigate to or be directed to the malicious page.

Business impact

This vulnerability poses a phishing and social engineering risk rather than a direct data breach or system compromise threat. Attackers can create convincing fake login prompts, security warnings, or payment interfaces within the browser context, potentially leading to credential theft or financial fraud. The impact is primarily on user trust and fraud exposure. Organizations with iOS users accessing sensitive applications through Chrome face increased risk of credential compromise. The relatively low CVSS score (4.3) reflects the requirement for user interaction and the limited direct confidentiality or availability impact, but the actual business risk depends on your user population's susceptibility to UI spoofing attacks.

Affected systems

Google Chrome for iOS prior to version 150.0.7871.47 is affected. Since Chrome on iOS runs on Apple's iOS/iPadOS platform and uses WebKit as the rendering engine, all iPhone and iPad users running vulnerable Chrome versions are in scope. Desktop Chrome (Windows, macOS, Linux) is not affected by this iOS-specific implementation flaw. Users should verify their installed Chrome version in iOS Settings > Google Chrome > About Chrome to check the current version number.

Exploitability

Exploitation is straightforward from an attacker perspective: create a malicious HTML page that exploits the UI spoofing weakness and distribute it via email, malicious ads, social media, or compromised websites. End users do not need to enable any special settings or grant unusual permissions. However, successful exploitation depends on user interaction and user deception—the attacker must convince the user to visit the malicious page and then interact with the spoofed UI. As of the publication date, this vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely documented, though the technique itself is well-understood in security research.

Remediation

Users should update Google Chrome on their iOS devices to version 150.0.7871.47 or later as soon as possible. Apple's App Store will distribute the patched version; users can check for updates by opening the App Store, navigating to their account profile, and refreshing to fetch pending updates. Organizations should communicate the availability of this patch to iOS users and encourage or mandate timely updates, especially for users accessing sensitive or financial applications through Chrome. For organizations requiring managed device updates, configure Mobile Device Management (MDM) profiles to enforce Chrome updates automatically.

Patch guidance

Google has released Chrome version 150.0.7871.47 for iOS to address this vulnerability. Users can obtain the patch through the Apple App Store; there is no separate security update—a regular Chrome app update contains the fix. Verify the installed version by launching Chrome, tapping the menu (three horizontal lines), selecting Settings, then About Chrome. The app will display the current version and check for updates automatically. If an update is available, the App Store will display an 'Update' button. No additional configuration or system settings changes are required following the update.

Detection guidance

Detection on individual devices is limited without device management tools, as the vulnerability requires analyzing rendered HTML content at runtime. However, security teams can monitor for suspicious Chrome-based phishing campaigns or user reports of unusual login prompts within Chrome. On the network level, monitor for unusual traffic to known malicious domains or newly registered domains that might host exploit pages. User awareness training focusing on identifying spoofed UI elements—such as misaligned buttons, unusual fonts, or out-of-context security prompts—can help reduce successful exploitation. Organizations using MDM solutions can check device inventory reports to identify iOS devices still running Chrome versions prior to 150.0.7871.47 and prioritize patching those devices.

Why prioritize this

While the CVSS score is medium (4.3) and the vulnerability does not pose direct system compromise, it should be prioritized based on your organization's exposure to phishing risk and the sensitivity of applications accessed via iOS Chrome. Prioritize patching for: (1) organizations handling financial transactions or sensitive authentication through iOS browsers; (2) environments with high-value targets for credential theft; (3) organizations with security-aware users who may be less susceptible to social engineering, allowing patching to follow normal cadence. Organizations in lower-risk categories may defer patching to the next routine mobile app update cycle, but should not leave users unpatched indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) reflects: Attack Vector Network (AV:N, remotely exploitable), Attack Complexity Low (AC:L, no special setup required), Privileges Required None (PR:N, no authentication or elevation needed), User Interaction Required (UI:R, user must visit the malicious page), Scope Unchanged (S:U, impact limited to the vulnerable app), Confidentiality None (C:N, no direct data exfiltration), Integrity Low (I:L, ability to present false information), and Availability None (A:N, no service disruption). The integrity impact is limited because the spoofing is UI-level; actual application or system functionality remains intact. The score appropriately reflects that exploitation depends on social engineering rather than technical bypass of strong security controls.

Frequently asked questions