CVE-2026-95288

chromium-browser: UI misrepresentation in Mobile

View on CVE.org
Published Sep 29, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

Google Chrome for iOS versions before 154.0.8037.57 contains a UI misrepresentation flaw that permits a remote attacker to cause the browser to display altered interface elements on a crafted HTML page. The attacker can superimpose or change on‑screen controls, and based on the description it is inferred that this could deceive users into interacting with fake input fields or other UI components. The weakness stems from insufficient validation of how the browser renders user‑supplied content and is classified as CWE‑451.

Affected Systems

Google Chrome on iOS, any version older than 154.0.8037.57. The issue affects all mobile builds of Chrome running on iOS devices that have not received the 154.0.8037.57 update.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to deliver a crafted web page that the user visits in Chrome on iOS. No local privileges or prior infection are necessary to trigger the UI misrepresentation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on iOS to version 154.0.8037.57 or later on all devices
  • If devices are managed, enforce automatic updates via the organization’s mobile device management system
  • Use Chrome’s Safe Browsing and content‑filtering features to limit exposure to potentially malicious web pages

Generated by OpenCVE AI on September 29, 2026 at 23:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History
Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML chromium-browser: UI misrepresentation in Mobile
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os
Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References
Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 29, 2026, 6:40 PM
Reserved
Sep 22, 2026, 5:07 AM

View source JSON

Updated
Sep 29, 2026, 6:40 PM

JSON

Status
Analyzed
Published
Sep 29, 2026, 6:17 PM
Modified
Sep 30, 2026, 4:30 PM

View source JSON

Severity
Low
Public date
Sep 29, 2026, 5:31 PM

View source Bugzilla JSON

Updated
Sep 29, 2026, 11:30 PM

JSON