CVE-2026-14128: Chrome iOS Omnibox Spoofing Vulnerability – Patch v150.0.7871.47

Technical summary

CVE-2026-14128 stems from an inappropriate implementation in Chrome's iOS Omnibox rendering logic. The vulnerability allows a remote attacker to craft HTML content that causes the URL bar to display arbitrary text, misrepresenting the page's origin. The attack vector is network-based with low complexity; it requires user interaction (viewing the address bar) to be effective. The flaw is classified under CWE-451 (User Interface Inconsistency), reflecting the mismatch between the displayed URL and the actual page context. Google assigned this a Low severity rating within Chromium's security framework, though the CVSS 3.1 score of 4.3 reflects moderate impact due to the integrity violation (information disclosure through UI spoofing).

Business impact

The primary business risk is phishing and credential harvesting. Users relying on the address bar as a trust indicator could be deceived into entering passwords or sensitive data on attacker-controlled pages they believe are legitimate. For organizations whose employees rely on iOS devices for access to corporate resources, this creates a social engineering surface. The requirement for user interaction and the low severity rating limit the threat scope compared to remote code execution vulnerabilities, but the reputational and compliance implications of browser UI spoofing warrant attention. Financial institutions, government agencies, and high-value targets are most at risk from targeted attacks.

Affected systems

Google Chrome on iOS versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the iOS implementation; desktop Chrome browsers are not impacted by this particular flaw. Since Chrome on iOS relies on WebKit per Apple's App Store policies, the underlying rendering engine is shared, but the Omnibox spoofing appears unique to the iOS UI implementation. All users of Chrome on iPhone or iPad running version 150.0.7871.46 or earlier are vulnerable.

Exploitability

Exploitability is moderate. An attacker must host a crafted HTML page and convince a user to visit it—a standard phishing precondition. The attack does not require the victim to click anything beyond normal browsing; simply loading the malicious page and viewing the address bar triggers the spoofing. No authentication, special privileges, or complex setup are needed from the attacker's side. However, the user must actively look at the Omnibox for the deception to be effective, which is not guaranteed. No public exploits or active exploitation in the wild have been reported as of the publication date.

Remediation

Update Chrome for iOS to version 150.0.7871.47 or later. The fix addresses the Omnibox rendering logic to prevent URL spoofing. Users should enable automatic app updates in the iOS App Store settings to receive patches without manual intervention. Organizations should communicate the availability of this patch to their workforce, particularly those handling sensitive communications or credentials via mobile devices.

Patch guidance

Verify that your iOS devices are running Chrome version 150.0.7871.47 or newer. Navigate to Settings > Apps > Chrome > App Info to check the current version. If running an earlier version, visit the App Store and update Chrome. For managed devices in an MDM environment, deploy the update through your mobile device management platform to ensure prompt rollout. Testing is low-risk since this is a security patch addressing UI rendering; standard regression testing for Omnibox behavior (URL display, navigation) is sufficient before enterprise deployment.

Detection guidance

Detection on the endpoint is limited; the vulnerability is a UI-layer issue rather than a system-level compromise. Monitor for unusual phishing attempts targeting your organization that specifically reference Chrome or iOS users, as attackers may craft campaigns exploiting this spoofing capability. User reports of mismatched URLs in the address bar should be escalated. Network-level detection is not applicable since this is a local rendering flaw. Security awareness training should emphasize verifying full URLs and using organization-approved authentication methods (e.g., SAML, SSO) rather than trusting the address bar alone.

Why prioritize this

While assigned Low severity by Chromium, this vulnerability merits prompt patching due to its phishing vector and the prevalence of iOS Chrome use in mobile-first environments. The CVSS 4.3 MEDIUM score reflects integrity impact. It should not be prioritized above critical remote code execution flaws, but it should not be deferred indefinitely. Organizations with significant iOS deployments or high-value targets should prioritize this; smaller organizations can include it in regular patch cycles. The absence of active exploitation reduces urgency, but early patching is still recommended.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity and no special privileges required, but the need for user interaction limits the base score. The integrity impact (Spoofing) outweighs the lack of confidentiality or availability impact. Chromium's Low severity designation aligns with the reality that this is a UI deception rather than a system compromise; however, the deception's use in phishing raises the practical security concern above the raw technical metric. The score appropriately captures a moderate threat with limited but real business consequence.

Frequently asked questions