Description
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Chrome for iOS suffers from insufficient validation of untrusted input, allowing a remote attacker to craft an HTML page that can mimic or overlay legitimate user interface components. The flaw, classified as a CWE‑451 weakness, can deceive users into interacting with deceptive elements, potentially leading to unintended actions or credential disclosure. Chromium has rated the issue as low severity.

Affected Systems

The vulnerability affects Google Chrome for iOS versions earlier than 150.0.7871.47. No other vendors or products are impacted.

Risk and Exploitability

The CVSS score of 4.3 reflects a low severity rating, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Because the weakness operates during the rendering of untrusted HTML, the most likely attack requires a victim to view a maliciously crafted page in Chrome, after which the attacker can perform UI spoofing. No privileged access is needed beyond the normal user’s interaction with the browser.

Generated by OpenCVE AI on July 17, 2026 at 13:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome for iOS to version 150.0.7871.47 or newer to eliminate the untrusted input validation issue.
  • Enable Chrome’s built‑in phishing and malicious site protection to warn users before loading potentially deceptive content, or restrict untrusted web content on devices that cannot run the newer release.
  • Block or filter URLs that serve malicious or spoofing content using domain reputation lists or enterprise web filters to prevent access to vulnerable pages.

Generated by OpenCVE AI on July 17, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Fri, 17 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Untrusted Input in Chrome for iOS

Thu, 16 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Insufficient Validation of Untrusted Input in Chrome for iOS

Tue, 14 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Insufficient Validation of Untrusted Input in Chrome for iOS

Sun, 12 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Insufficient Input Validation in Chrome for iOS

Sat, 11 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Insufficient Input Validation in Chrome for iOS

Thu, 09 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Untrusted Input Validation

Wed, 08 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Untrusted Input Validation

Tue, 07 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Crafted HTML

Mon, 06 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Crafted HTML

Mon, 06 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title Untrusted Input Allows Remote UI Spoofing in Chrome for iOS

Sun, 05 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Untrusted Input Allows Remote UI Spoofing in Chrome for iOS

Sat, 04 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Untrusted Input in Chrome for iOS

Sat, 04 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Untrusted Input in Chrome for iOS

Sat, 04 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing Vulnerability

Fri, 03 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing Vulnerability

Fri, 03 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Untrusted Input in Chrome for iOS

Thu, 02 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title UI Spoofing via Untrusted Input in Chrome for iOS

Thu, 02 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Unvalidated Input

Thu, 02 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Chrome for iOS UI Spoofing via Unvalidated Input

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation Leads to UI Spoofing in Chrome for iOS
Weaknesses CWE-20

Wed, 01 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation Leads to UI Spoofing in Chrome for iOS
Weaknesses CWE-20

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T14:50:08.822Z

Reserved: 2026-06-29T23:11:49.189Z

Link: CVE-2026-14136

cve-icon Vulnrichment

Updated: 2026-07-01T14:50:02.956Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T13:45:05Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information