CVE-2026-13981: Chrome iOS UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-13981 is a medium-severity UI spoofing flaw in Chrome for iOS versions prior to 150.0.7871.47, arising from inappropriate implementation of UI isolation or rendering controls. The vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating a failure to properly distinguish user-controlled content from browser-provided UI elements. The attack vector is network-based with low complexity; it requires user interaction to click or interact with the spoofed page but does not require authentication. The impact is limited to integrity—attackers cannot steal data or crash the browser, but can manipulate perceived trust signals.

Business impact

UI spoofing attacks undermine user trust in mobile banking, payment apps, and credential entry flows. Employees using Chrome on iOS for work email, SaaS authentication, or internal portals risk phishing and social engineering. The threat is primarily reputational and social-engineering-driven rather than system-compromising, but can facilitate downstream attacks (credential theft, malware distribution via fake install prompts) if users are successfully deceived.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the iOS platform and does not affect Chrome on Android, Windows, macOS, or Linux. iPhone and iPad users running vulnerable Chrome versions are at risk. The scope is unchanged—impacts only the iOS browser instance, not the underlying iOS system or other applications.

Exploitability

Exploitability is straightforward but requires user action. An attacker must host or distribute a crafted HTML page and convince or trick a user into visiting it in Chrome on iOS. No special network position, authentication, or click-jacking is required. The low complexity and network-accessible nature make this suitable for mass distribution via phishing, ads, or social media. However, the lack of KEV (Known Exploited Vulnerability) status as of the publication date suggests this flaw has not yet been observed in active attack campaigns at scale.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users can enable automatic app updates in the Apple App Store settings to receive fixes passively. Organizations managing iOS devices via MDM should deploy Chrome update policies to ensure timely patching. No workarounds are documented; patching is the primary mitigation.

Patch guidance

Verify the installed Chrome version on iOS devices (Settings > Chrome > About Chrome). If the version is below 150.0.7871.47, navigate to the App Store and install the latest update. For organizations: deploy Mobile Device Management (MDM) policies to enforce Chrome auto-update or mandated version minimums. Test with a small pilot group before enterprise-wide rollout if your security posture depends on verified Chrome versions.

Detection guidance

Monitor user reports of suspicious Chrome UI behavior—especially spoofed address bars, warning dialogs, or login prompts that appear unusual. Endpoint logging on managed devices can flag Chrome version inventory; alert on versions below 150.0.7871.47. Phishing simulation campaigns can test user awareness of UI-spoofed pages. No network-level signatures are practical since attack HTML is variable; focus on user education and version enforcement.

Why prioritize this

Although rated medium-severity, this flaw should be prioritized for iOS users because (1) iOS Chrome is heavily used for banking and email on personal and corporate devices, (2) UI spoofing is a high-confidence social engineering vector, (3) the patch is low-friction (app store update), and (4) the attack requires no special exploits—a simple HTML file is sufficient. Organizations with BYOD or strong iOS populations should accelerate patching. Lower priority for Linux/Windows/macOS-only environments.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects network-accessible attack surface (AV:N), low complexity (AC:L), no authentication (PR:N), required user interaction (UI:R), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L, limited to UI deception), and no availability impact (A:N). The score appropriately captures that the damage is limited to user trust manipulation, not data breach or system compromise. Chromium's own medium rating aligns with this assessment.

Frequently asked questions