Description
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-09-29
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: UI Spoofing via Crafted HTML
Action: Patch
AI Analysis

Impact

A flaw in the user‑interface rendering of Google Chrome on iOS permits a remote attacker to spoof UI elements through a specially crafted HTML page. The browser may display forged interface components that appear authentic, which is classified as CWE‑451 – information exposure by unintended display. The primary impact is deceptive visual representation rather than direct data or code compromise as stated in the advisory.

Affected Systems

Google Chrome on iOS versions earlier than 154.0.8037.57 are affected. Devices that have not installed this patch remain vulnerable to the described UI spoofing flaw.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector, inferred from the description, is a user visiting a malicious web page that supplies the deceptive HTML content; no privileged access is required. Because the flaw relies on the user’s browser rendering, mitigation primarily focuses on software updates and user awareness.

Generated by OpenCVE AI on September 29, 2026 at 22:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome for iOS to version 154.0.8037.57 or newer via the App Store.
  • Enable automatic updates so future patches are applied automatically.
  • Limit exposure by avoiding suspicious web pages and consider device restrictions that block potentially malicious sites.

Generated by OpenCVE AI on September 29, 2026 at 22:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML chromium-browser: UI misrepresentation in Mobile
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Tue, 29 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS UI Spoofing via Crafted HTML

Tue, 29 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-451
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T18:40:57.881Z

Reserved: 2026-09-22T05:08:15.098Z

Link: CVE-2026-95309

cve-icon Vulnrichment

Updated: 2026-09-29T18:40:17.046Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:23.000

Modified: 2026-09-30T20:19:13.113

Link: CVE-2026-95309

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-29T17:31:59Z

Links: CVE-2026-95309 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T23:00:18Z

Weaknesses
  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information