CVE-2026-13983: Chrome iOS Omnibox Spoofing Vulnerability – Patch Guidance

Technical summary

CVE-2026-13983 stems from an inappropriate implementation in Chrome's iOS rendering engine related to Omnibox state management. The vulnerability allows DOM manipulation or JavaScript execution on a webpage to trigger a visual spoofing of the URL bar, causing it to display a different address than the one actually loaded. The attack vector requires user interaction—specifically, a crafted HTML page must guide the user through deliberate UI gestures that trigger the spoofing condition. The vulnerability is categorized under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating that the browser fails to authentically represent critical navigation information to the user. CVSS 3.1 scoring of 4.2 reflects the requirement for user interaction and the limited scope of impact (integrity and availability concerns only, no confidentiality breach).

Business impact

While the CVSS score is medium and the vulnerability requires active user manipulation, the business risk should not be underestimated. Omnibox spoofing is a proven vector for phishing and credential harvesting attacks. Users may enter login credentials, payment information, or other sensitive data into what they believe is a trusted site's login form, when in fact they are on an attacker-controlled page. Organizations with employees using Chrome on iOS devices (iPhones and iPads) face increased exposure to social engineering campaigns. The impact depends on user awareness: organizations with strong security awareness training may see lower incident rates, while those without may face compromised credentials and potential lateral movement within corporate networks.

Affected systems

The vulnerability affects Google Chrome on iOS (running on Apple iPhone OS) in all versions prior to 150.0.7871.47. This includes both iPhone and iPad devices running Chrome. Android Chrome is not affected by this specific vulnerability. Users running Chrome version 150.0.7871.47 or later are protected. Organizations should verify the Chrome version deployed on iOS devices through their mobile device management (MDM) solutions or by checking Settings > Chrome in the Chrome app itself.

Exploitability

Exploitation requires active user interaction, which is a limiting factor. An attacker must craft a HTML page and convince a user to visit it, then manipulate the user into performing specific UI gestures (taps, swipes, or other touch interactions) to trigger the spoofing effect. The attack cannot be carried out silently or through passive viewing of a webpage. However, the threshold for user manipulation is relatively low—users may innocently perform normal browsing gestures without realizing they are triggering a security issue. Given that this is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, there is no evidence of active exploitation in the wild at the time of publication, but organizations should not assume indefinite safety. The vulnerability is discoverable through testing and may eventually attract threat actor attention.

Remediation

The primary remediation is to update Google Chrome on iOS to version 150.0.7871.47 or later. Users and administrators should enable automatic updates in Chrome settings to ensure the patch is applied promptly. For organizations managing iOS devices via MDM, ensure that app update policies are configured to deploy the latest Chrome version. No workaround exists short of disabling Chrome or using alternative browsers; the vulnerability cannot be mitigated at the network or OS level without updates to Chrome itself. Note: verify the exact patch version against Google's official Chrome release notes and security advisory to confirm availability on your target OS version.

Patch guidance

Google has addressed this vulnerability in Chrome 150.0.7871.47 for iOS. To apply the patch: (1) On iOS devices, open the Chrome app and navigate to Settings > About Chrome. The app will check for updates automatically; if an update is available, tap 'Update Chrome' or allow the automatic update to proceed. (2) Organizations using MDM solutions (such as Apple Business Manager or third-party platforms) should configure policies to enforce automatic app updates or push Chrome 150.0.7871.47+ through their app deployment channels. (3) Verify the update has been applied by checking Settings > About Chrome and confirming the version number is 150.0.7871.47 or higher. (4) Test functionality in your environment to ensure the patch does not introduce compatibility issues with internal web applications.

Detection guidance

Detection of exploitation attempts is challenging because the attack relies on user interaction with a malicious webpage. Monitor for indicators such as: (1) Unusual variations in phishing or spear-phishing emails targeting iOS users with links to suspicious sites, which may be attempts to trigger Omnibox spoofing; (2) User reports of unusual browser behavior or concern about whether they were on the correct website; (3) Credential compromise incidents that correlate with users on iOS devices around the same timeframe; (4) Web proxy or DNS logs showing access to credential harvesting domains from iOS user agents. Implement user awareness training to help employees recognize signs of spoofing and verify URLs carefully before entering sensitive information. Organizations with access to Chrome Enterprise policies can enable additional logging or use endpoint detection and response (EDR) tools to monitor Chrome process behavior on iOS, though native iOS sandboxing limits the depth of telemetry available.

Why prioritize this

This vulnerability should be prioritized for patching in the medium-risk category. The CVSS score of 4.2 and requirement for user interaction limit the urgency compared to critical remote code execution bugs, but the attack type—Omnibox spoofing—is a proven social engineering vector that directly enables credential theft. Organizations with significant iOS user populations, especially those with high-value targets (finance, healthcare, government), should accelerate patching. The lack of KEV status and known active exploitation reduces immediate pressure, but waiting for evidence of attacks in the wild is a reactive posture. Organizations should treat this as a standard priority patch with a target deployment window of 4–6 weeks, depending on risk tolerance and the size of affected mobile device inventory.

Risk score, explained

The CVSS 3.1 score of 4.2 (Medium) reflects: (1) Network attack vector (AV:N) — the attacker can deliver the malicious HTML page over the internet; (2) High attack complexity (AC:H) — the attacker must craft specific UI conditions and convince the user to perform deliberate gestures; (3) No privileges required (PR:N) — the attacker does not need prior access; (4) Required user interaction (UI:R) — the attack cannot succeed without active user participation; (5) Unchanged scope (S:U) — the impact is limited to the Chrome app itself; (6) No confidentiality impact (C:N) — no data breach; (7) Low integrity and availability impacts (I:L, A:L) — the spoofing misleads the user and may degrade trust in navigation, but does not directly compromise data. The score appropriately reflects a social engineering risk rather than a direct system compromise. However, the business context—credential harvesting potential—warrants consideration of organizational risk appetite beyond the numerical score.

Frequently asked questions