Description
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-09-29
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: UI Spoofing (Phishing)
Action: Patch Chrome
AI Analysis

Impact

Google Chrome for iOS versions before 154.0.8037.57 contains a UI misrepresentation flaw that permits a remote attacker to cause the browser to display altered interface elements on a crafted HTML page. The attacker can superimpose or change on‑screen controls, and based on the description it is inferred that this could deceive users into interacting with fake input fields or other UI components. The weakness stems from insufficient validation of how the browser renders user‑supplied content and is classified as CWE‑451.

Affected Systems

Google Chrome on iOS, any version older than 154.0.8037.57. The issue affects all mobile builds of Chrome running on iOS devices that have not received the 154.0.8037.57 update.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to deliver a crafted web page that the user visits in Chrome on iOS. No local privileges or prior infection are necessary to trigger the UI misrepresentation.

Generated by OpenCVE AI on September 29, 2026 at 23:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on iOS to version 154.0.8037.57 or later on all devices
  • If devices are managed, enforce automatic updates via the organization’s mobile device management system
  • Use Chrome’s Safe Browsing and content‑filtering features to limit exposure to potentially malicious web pages

Generated by OpenCVE AI on September 29, 2026 at 23:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML chromium-browser: UI misrepresentation in Mobile
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 30 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Tue, 29 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T18:40:57.749Z

Reserved: 2026-09-22T05:07:24.502Z

Link: CVE-2026-95288

cve-icon Vulnrichment

Updated: 2026-09-29T18:40:11.903Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:20.510

Modified: 2026-09-30T16:30:27.153

Link: CVE-2026-95288

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-29T17:31:59Z

Links: CVE-2026-95288 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T23:30:19Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information