CVE-2026-14028: Chrome iOS UI Spoofing Vulnerability – CVSS 4.2 Patch Guidance

Technical summary

CVE-2026-14028 is an incorrect security UI vulnerability in the Chromium rendering engine on iOS. The flaw stems from improper validation or rendering of security UI elements (CWE-451: User Interface (UI) Misrepresentation of Critical Information), allowing remote attackers to overlay or replace legitimate browser UI with spoofed elements. Exploitation requires network accessibility and relies on social engineering to trigger specific UI gestures that activate the vulnerable code path. The issue was addressed in Chrome 150.0.7871.47 for iOS.

Business impact

This vulnerability poses a moderate risk to iOS users relying on Chrome as their primary browser. The threat model centers on credential harvesting and social engineering—an attacker could display fake login prompts, payment forms, or security warnings that appear legitimate. Users may unknowingly enter sensitive information into attacker-controlled fields. Organizations whose employees use Chrome on personal or corporate iOS devices should consider the risk of phishing campaigns leveraging this UI spoofing technique. The impact is limited by the requirement for user interaction and the specificity of the gestures needed to trigger the flaw.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 150.0.7871.47 are affected. This includes all iPhone and iPad models capable of running the affected Chrome versions. Android, macOS, Windows, and Linux versions of Chrome are not affected by this particular vulnerability. Users running Chrome 150.0.7871.47 or later on iOS are not vulnerable.

Exploitability

Exploitability is moderate. While the attack requires network access (the attacker must serve a crafted HTML page), it also requires active user participation—the victim must visit the malicious page and perform specific UI gestures as directed or tricked by the attacker. This is not a drive-by attack; social engineering is a necessary component. The attack surface is limited to iOS users, and the barrier to user interaction reduces the likelihood of widespread automated exploitation. No public exploit code or active exploitation has been documented at publication.

Remediation

Users should update Chrome on iOS to version 150.0.7871.47 or later immediately. Apple's App Store typically auto-updates Chrome for users who have enabled automatic updates, though manual verification is recommended. Organizations managing corporate iOS deployments should verify update deployment through mobile device management (MDM) solutions. No workarounds exist other than avoiding untrusted webpages or disabling Chrome in favor of Safari until patching is complete.

Patch guidance

Navigate to the App Store on your iOS device, search for Google Chrome, and tap 'Update' if available. Alternatively, enable automatic app updates in App Store settings (Settings > App Store > App Updates > toggle 'Automatic Updates'). Verify the installed version by opening Chrome, tapping the menu button, and checking 'About Google Chrome'—it should display version 150.0.7871.47 or higher. Organizations should deploy this update via MDM policies targeting all managed iOS devices running Chrome.

Detection guidance

Monitor for suspicious Chrome-related user reports mentioning unexpected login screens, payment forms, or security warnings. Security teams can review web proxy or DNS logs for requests to known malicious domains crafting Chrome UI spoofing pages, though detection is challenging without endpoint telemetry. On iOS, endpoint detection and response (EDR) tools with browser extension monitoring may identify anomalous behavior post-exploitation (e.g., credential submission to attacker infrastructure). Since the vulnerability requires specific gestures and user interaction, detection will primarily rely on user reporting and post-incident forensics rather than proactive monitoring.

Why prioritize this

Despite the CVSS 3.1 score of 4.2 (Medium), this vulnerability should be prioritized for rapid patching because UI spoofing is a highly effective social engineering vector. Users trust browser UI, and a successful spoof can lead to credential compromise or malware distribution. However, it is not a critical priority because exploitation requires deliberate user interaction and is not known to be actively exploited. iOS-centric organizations and those with high bring-your-own-device (BYOD) adoption should treat this with higher urgency.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a Medium severity rating with limited attack complexity (AC:H) and user interaction requirement (UI:R). The attack vector is network-based (AV:N), scope is unchanged (S:U), confidentiality is not impacted (C:N), but integrity and availability are degraded slightly (I:L, A:L). The score acknowledges the realistic barrier of requiring specific user gestures and the inability to directly compromise system confidentiality. However, the moderate score understates the real-world risk of UI spoofing leading to credential theft; users' inherent trust in browser UI makes this threat more dangerous than the numerical score suggests.

Frequently asked questions