Description
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-09-29
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Phishing via UI spoofing leading to credential theft
Action: Patch
AI Analysis

Impact

This vulnerability involves the representation of the sign‑in interface on Google Chrome for iOS. A malicious web page can cause Chrome to display spoofed UI elements that appear to be legitimate sign‑in prompts. The attack could lead an unsuspecting user to enter credentials on a counterfeit interface, resulting in credential compromise or phishing. The weakness corresponds to improper handling of dynamic UI rendering (CWE-451) and unvalidated input that can inject UI elements (CWE-1021).

Affected Systems

Affected product is Google Chrome for iOS, with all releases prior to version 154.0.8037.92 impacted. The vulnerability is limited to iOS devices running the affected Chrome build.

Risk and Exploitability

The likely attack vector is a remote attacker hosting a crafted HTML page that the victim opens in the affected Chrome browser. The CVSS score of 5.4 places the vulnerability in the low to moderate severity band. An EPSS score of < 1% indicates a low likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Successful exploitation results in credential theft through deceptive UI, but does not grant direct code execution or system compromise. The flaw involves both CWE-451 and CWE-1021, indicating potential for UI injection and unvalidated rendering.

Generated by OpenCVE AI on October 4, 2026 at 13:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome for iOS to version 154.0.8037.92 or later.
  • Verify that Chrome’s Safe Browsing feature is enabled to help detect spoofed UI elements.
  • If the device cannot update Chrome immediately, consider using a different browser or wait until the update is available.
  • Avoid entering credentials on any sign‑in screen that does not match Chrome’s trusted UI; if suspicious, close the tab immediately.

Generated by OpenCVE AI on October 4, 2026 at 13:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4811-1 chromium security update
Debian DSA Debian DSA DSA-6535-1 chromium security update
History

Sun, 04 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via SignIn Page in Chrome for iOS chromium-browser: chromium-browser: UI misrepresentation in SignIn
Weaknesses CWE-1021
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 30 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 30 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via SignIn Page in Chrome for iOS

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T20:24:40.491Z

Reserved: 2026-09-28T21:44:10.364Z

Link: CVE-2026-102305

cve-icon Vulnrichment

Updated: 2026-09-29T20:24:33.195Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T20:17:13.450

Modified: 2026-09-30T16:43:46.327

Link: CVE-2026-102305

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T19:45:07Z

Links: CVE-2026-102305 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T14:00:16Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames

  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information