CVE-2026-14068: iOS Chrome Omnibox UXSS Vulnerability (v150.0.7871.47)

Technical summary

CVE-2026-14068 is a user-experience-based cross-site scripting (UXSS) vulnerability stemming from inappropriate implementation in the Omnibox component of Chromium on iOS. The flaw permits script or HTML injection when a remote attacker convinces a user to execute specific UI gestures on a malicious page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Although Chromium assigned this a 'Low' internal severity rating, the CVSS 3.1 assessment reflects MEDIUM severity (6.1) due to the cross-site scope and potential for both confidentiality and integrity impact, despite the requirement for user interaction.

Business impact

iOS users running vulnerable versions of Chrome face risk of session hijacking, credential theft, or malware delivery if they visit a compromised or attacker-controlled website and perform the required gestures. The relatively low bar for triggering the flaw—ordinary browsing with specific UI interactions—means risk exposure is material for any organization with BYOD policies or employees using Chrome on iPhones. Organizations managing mobile device policies should treat this as a medium-priority update to reduce the attack surface in their iOS fleet.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 150.0.7871.47 are vulnerable. The flaw does not affect Chrome on Android, macOS, Windows, Linux, or other platforms—it is specific to the iOS implementation of the Omnibox. Any iPhone or iPad running Chrome below the patched version should be considered at risk.

Exploitability

Exploitation requires network-level access (attacker must serve a crafted HTML page) and user interaction; the user must visit the malicious page and perform specific gestures in the Omnibox. There is no evidence of public exploit code or active in-the-wild exploitation. The attack is not trivial to execute reliably, but for a targeted attack against a known user, the bar is reasonable. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting limited real-world activity to date.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. Users should enable automatic updates in the App Store to receive security patches promptly. Organizations should communicate the update to employees with iOS devices and consider forcing an update deadline via mobile device management (MDM) policies if feasible. No workarounds are available short of disabling or uninstalling Chrome on iOS.

Patch guidance

Verify that Google Chrome on iOS has been updated to 150.0.7871.47 or a newer release. Users can confirm the installed version by opening Chrome, navigating to Settings > About Chrome, which will show the current version number and trigger an automatic update check if one is available. MDM administrators managing iOS devices should push this update via their deployment system to ensure compliance across the fleet. If your organization prohibits automatic App Store updates, manual deployment or a grace period for user-initiated updates is recommended.

Detection guidance

Monitor for unusual script execution or HTML injection events in web application logs, particularly if originating from iOS Chrome user agents. Endpoint detection and response (EDR) tools on managed devices may flag suspicious script behavior. Network intrusion detection systems (IDS) can look for telemetry patterns consistent with UXSS exploitation, though detection is difficult without application-level visibility. The best detection mechanism is verifying that all iOS devices have been upgraded past the vulnerable version via MDM compliance reporting.

Why prioritize this

Although the Chromium team rated this Low severity, the CVSS score of 6.1 (MEDIUM) reflects genuine cross-site impact and the potential for information disclosure or content manipulation. The main mitigating factor is the user interaction requirement; however, this is not a strong barrier for targeted or watering-hole attacks. Prioritize this for organizations with significant BYOD iOS usage or where employees frequently access sensitive web applications from iPhones. It should be patched within 2–4 weeks, ahead of any zero-day or exploit disclosure.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a MEDIUM severity rating. Network-based attack vector (AV:N) and low attack complexity (AC:L) are balanced against the requirement for user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component—typical of UXSS. Low confidentiality (C:L) and integrity (I:L) impact account for the ability to read or modify page content, while no availability (A:N) impact is recognized. The score does not include exploitability adjustments (not in CVSS 3.1), so real-world likelihood of exploitation is a separate consideration that argues for timely patching.

Frequently asked questions