CVE-2026-14123: Chrome iOS Address Bar Spoofing Vulnerability

Technical summary

CVE-2026-14123 stems from an incorrect security UI implementation in Chrome's iOS address bar component. The vulnerability exists in the Omnibox rendering logic, where insufficient validation of URL display state allows a remote attacker to manipulate the visual presentation of the address bar through crafted HTML. The underlying weakness is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating the security issue manifests as a breakdown in how the browser communicates authenticity cues to the user. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for user interaction (visiting the malicious page) and the integrity impact limited to information display rather than system compromise.

Business impact

This vulnerability directly undermines the primary visual mechanism users employ to verify website authenticity on mobile devices. Organizations with employees who rely on iOS Chrome face increased phishing risk, as attackers can now combine this spoofing flaw with credential harvesting pages to convincingly impersonate banking portals, email services, or internal corporate domains. The attack is particularly dangerous on mobile, where address bar visibility is limited and users are conditioned to trust visual cues. Incident response teams should anticipate an uptick in socially engineered attacks targeting iOS Chrome users during the window before patch adoption.

Affected systems

Apple iPhone OS devices running Google Chrome version 149 and earlier are affected. The vulnerability is specific to Chrome's iOS implementation and does not impact Chrome on other platforms (Android, Windows, macOS, Linux). Users of Safari, Firefox, or other browsers on iOS are not affected. The fix is available in Chrome for iOS version 150.0.7871.47 and later.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker need only host a specially crafted HTML page and trick a user into visiting it via phishing, malvertising, or social engineering. The attack requires user interaction (the victim must navigate to or remain on the malicious page), but no special network position or privileged access is needed. No authentication bypass or system-level privilege escalation is possible through this vector alone. The attack is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not yet been widespread or publicly disclosed, though the simplicity of the attack means it could be weaponized quickly.

Remediation

Update Chrome on iOS to version 150.0.7871.47 or later. This update patches the Omnibox rendering logic to correctly validate and display URL information. For organizations managing iOS devices via Mobile Device Management (MDM), ensure Chrome is included in your application update policies with a high priority. Consider interim compensating controls: user awareness training on address bar verification and the dangers of clicking untrusted links, combined with DNS filtering to block known malicious domains.

Patch guidance

Patches are available immediately through Apple's App Store. End users can enable automatic app updates in the App Store settings (Settings > [Your Name] > iTunes and App Store > App Updates) to receive Chrome 150.0.7871.47 automatically. Enterprise administrators should review their MDM policies and push Chrome updates to all managed iOS devices within 30 days. Verify the patched version number in Chrome's About section (Chrome menu > About Google Chrome) to confirm successful installation.

Detection guidance

Detection is challenging because the attack leaves no network artifacts that distinguish it from legitimate browsing. Log aggregation systems should focus on user reports of unexpected URL bar behavior or suspicious login attempts from iOS devices. Consider implementing security awareness monitoring to flag users who report seeing discrepancies between the address bar and page content. Endpoint detection platforms with iOS support may flag the delivery of the malicious HTML, but the browser-level spoofing itself is difficult to detect without examining the browser's internal state. Recommend users report any address bar anomalies to security teams immediately.

Why prioritize this

Although the CVSS score is MEDIUM (4.3) and this is not a KEV vulnerability, the risk to end users is non-trivial because the attack directly exploits human trust in visual UI elements. Mobile users are particularly vulnerable because screen real estate is limited and address bar verification is harder. Prioritize this patch for organizations with significant BYOD policies or iOS-heavy workforce demographics, especially those in finance, healthcare, or government sectors where phishing attacks are frequent and high-value. For consumer-focused companies, the risk is lower but still warrants expedited patching to maintain user trust.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-based attack vector requiring no special access; (2) Low attack complexity—the attacker simply hosts a webpage; (3) No privileges required; (4) User interaction required (victim must navigate to the page); (5) Scope unchanged (the impact is limited to the browser's UI); (6) No confidentiality impact; (7) Low integrity impact (the displayed URL is spoofed, but no data exfiltration occurs); and (8) No availability impact. The MEDIUM severity label appropriately captures that this is a social engineering amplifier rather than a direct system compromise. The relatively low score should not lull defenders into complacency: phishing effectiveness increases substantially when attackers can spoof the address bar.

Frequently asked questions