CVE-2026-14143: Chrome iOS Password UI Spoofing Vulnerability – Patch Guide

Technical summary

CVE-2026-14143 is an incorrect security UI vulnerability in the Passwords feature of Google Chrome for iOS. The flaw stems from inadequate validation or rendering of security-critical UI elements, classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). An attacker can deliver a crafted HTML page that spoofs Chrome's password-related dialogs or warnings, exploiting the browser's failure to properly distinguish between trusted security UI and attacker-controlled content. The vulnerability requires user interaction and affects iOS versions of Chrome prior to 150.0.7871.47. Chromium's assessment rated this as Low severity from an internal standpoint, though the CVSS score reflects a Medium severity due to the potential for user deception and subsequent credential compromise.

Business impact

The primary business risk is credential theft through social engineering. Employees using Chrome on iOS may be deceived into entering passwords or sensitive data when presented with spoofed security prompts that appear legitimate. This is particularly concerning for organizations with iOS-heavy workforces or BYOD policies, as the attack requires no special privileges and can be delivered via email, messaging, or web links. The attack succeeds only if users interact with the malicious page, meaning awareness and user behavior are key mitigating factors. For enterprises managing Chrome deployments on corporate iOS devices, the risk centers on potential compromise of company accounts and systems that rely on those credentials.

Affected systems

This vulnerability is specific to Google Chrome on Apple iOS. It does not affect Chrome on Android, Windows, macOS, Linux, or other platforms. Desktop users are not impacted. The vulnerability exists in Chrome versions prior to 150.0.7871.47 for iOS. Any organization or individual using Chrome as the primary browser on iPhones or iPads running affected Chrome versions is potentially at risk. Users on older iOS versions paired with older Chrome versions face compounded risk if both remain unpatched.

Exploitability

Exploiting this vulnerability requires a remote attacker to deliver a crafted HTML page to the target user. The attack is straightforward from a technical standpoint—no authentication, special network access, or browser exploitation is needed. However, the vulnerability critically depends on user interaction: the victim must visit the malicious page and engage with the spoofed UI element. This interaction requirement significantly lowers real-world exploitability compared to purely technical flaws. The attack is best suited to targeted campaigns or phishing attempts where the attacker controls the content the user visits. Broader exploit potential is limited because the attack relies on social engineering rather than automatic compromise.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. This is a straightforward remediation: users should enable automatic updates in the App Store or manually check for updates to Chrome. Organizations managing iOS devices through mobile device management (MDM) platforms can enforce Chrome updates as part of their patch management policy. No workaround exists for unpatched versions; the only mitigation is avoiding clicking links in untrusted emails or messages that might lead to spoofed password-entry pages. Educating users about verifying security prompts before entering credentials is a complementary defensive measure.

Patch guidance

Verify that Chrome on iOS has been updated to version 150.0.7871.47 or later by opening the App Store, navigating to the Updates tab, and confirming Chrome's version number. Users can also enable automatic app updates in the App Store settings to ensure future security patches are applied without manual intervention. For enterprise deployments using MDM, configure policies to enforce minimum Chrome version requirements and to push updates automatically to managed devices. Testing the patch in a staging environment is recommended for organizations with critical workflows dependent on Chrome for iOS before full rollout.

Detection guidance

Detection of exploitation attempts is challenging because the attack manifests as user interaction with a malicious webpage rather than as a network-level or system-level event. Security teams should monitor for suspicious iOS Chrome activity through endpoint detection and response (EDR) solutions if deployed on corporate devices. User reports of unexpected password prompts or unusual Chrome behavior should be taken seriously. Phishing and email security tools should be configured to flag or block emails containing links to known malicious domains or suspicious URLs. On the network level, DNS filtering or proxy-based content filtering can help block access to attacker-controlled sites, though determined users may circumvent such controls. User awareness training on recognizing spoofed prompts is the most practical detection and prevention measure.

Why prioritize this

Despite the CVSS score of 4.3 (Medium severity), this vulnerability should be prioritized for remediation in the near term but not classified as critical emergency. The reason: while the technical bar for exploitation is low and the vector is remote, the attack is purely social-engineering-based and requires user interaction. Organizations with strong security awareness programs and email filtering are at lower risk. However, the nature of the vulnerability—deceiving users about password entry—makes it attractive to attackers targeting specific individuals. Prioritize patching for users in high-value roles (executives, finance, IT administrators) and those handling sensitive systems. General user populations can follow standard patch cycles, though faster deployment is prudent given the ease of delivering the exploit via phishing.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity rating based on: (1) Network attack vector—the flaw can be exploited remotely via a crafted webpage; (2) Low attack complexity—no special conditions or bypasses are needed to craft the malicious page; (3) No privileges required—an unauthenticated attacker can launch the attack; (4) User interaction required—the victim must visit the page and interact with it, which is the primary limiting factor; (5) Integrity impact—successful exploitation can lead to credential disclosure or user deception, compromising data integrity. Confidentiality and availability are not directly affected. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) accurately captures that this is a social-engineering vulnerability with moderate real-world risk but limited technical severity.

Frequently asked questions