CVE-2026-13991: Chrome iOS UI Spoofing Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-13991 stems from insufficient input validation in Chrome for iOS prior to version 150.0.7871.47. The vulnerability is classified as CWE-20 (Improper Input Validation) and allows an attacker to craft HTML that bypasses UI element validation controls. By serving this malicious HTML to an iOS Chrome user, the attacker can overlay, redraw, or spoof legitimate browser UI, deceiving users about the actual state or origin of content they're viewing. The attack requires network connectivity and user interaction but does not require any special browser configuration or user privilege.

Business impact

UI spoofing attacks can lead to credential theft, malware distribution, or social engineering at scale. An attacker could impersonate a login screen, payment interface, or security warning to extract sensitive data or distribute malware. For iOS users relying on Chrome, this expands the attack surface beyond Safari-based threats. Organizations with iOS device policies that allow Chrome should consider the phishing and credential compromise risk, particularly for users handling sensitive transactions or authentication.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 150.0.7871.47 are affected. This is a Chrome for iOS-specific issue; Chrome on Android, Windows, macOS, and Linux are not affected by this particular vulnerability. iPhone and iPad users are at risk if they use Chrome as their primary browser.

Exploitability

Exploitability is straightforward: an attacker simply crafts a malicious HTML page and distributes it via phishing, ads, or compromised sites. The user must click a link and interact with the page, which is a common attack pattern. No zero-click or passive exploitation method is involved. Given the ubiquity of phishing and drive-by browsing, the bar for an attacker is low, though not zero. The CVSS score of 4.3 (Medium) and vector reflecting user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) appropriately capture this: network-accessible, low complexity, no privileges needed, requires user interaction, no confidentiality impact, limited integrity impact, and no availability impact.

Remediation

The immediate remedy is to update Chrome on iOS to version 150.0.7871.47 or later. Apple's App Store will push this update; users should ensure automatic updates are enabled or manually check for updates in the App Store. Organizations managing iOS devices via MDM should deploy the updated version as part of routine patch cycles. No workarounds are documented; full patching is required.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later on all managed and unmanaged iOS devices. Prioritize this update for users who rely on Chrome for sensitive tasks (banking, email access, corporate portals). Enable automatic app updates on iOS to minimize patching delays. Verify patch deployment through MDM telemetry or periodic app version audits.

Detection guidance

Detection of active exploitation is difficult because the attack occurs in the user's browser without leaving a distinctive trace in system logs. Monitor for user reports of unexpected behavior or prompts in Chrome. Consider deploying mobile threat defense (MTD) solutions that can intercept and analyze HTML content before rendering. Network-level indicators (malicious domains hosting spoofing pages) may be detected through DNS or proxy logs if users route traffic through corporate infrastructure. Encourage users to report suspicious interface behavior or unexpected login prompts.

Why prioritize this

Although rated Medium severity, this vulnerability merits prompt attention because UI spoofing directly enables phishing and social engineering at scale. The user-interaction requirement is low friction in practice; many users click links daily. iOS users may perceive the browser's UI as inherently trustworthy, making spoofing particularly effective. The lack of KEV listing suggests active in-the-wild exploitation has not yet been widely observed or reported, creating a window to patch before attackers at scale adopt it. Organizations should treat this as a standard-priority update (2–4 week rollout), not a critical emergency, but not indefinitely deferred.

Risk score, explained

The CVSS 4.3 Medium score reflects the attack vector (network, no special access needed), low complexity, user interaction requirement, and limited scope of integrity impact (only the appearance of UI, not the underlying system). The score does not account for the human/social engineering factor, which elevates real-world risk. The absence of confidentiality and availability impact keeps the score moderate. Internally, SEC.co may weight this higher for organizations where iOS Chrome use is endemic or where phishing is a top threat vector.

Frequently asked questions