EUVD-2026-34741
GHSA-hgx4-2wp8-x7xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker server
-
DeliveryDeliver link to iOS Chrome user via phishing or redirect
-
ExploitUser visits page in Chrome on iOS
-
ExecutionCrafted page triggers inappropriate Signin UI rendering
-
PersistSpoofed signin interface presented to victim
-
ImpactVictim submits credentials to attacker-controlled form
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to be using Google Chrome on iOS (not Chrome on Android or desktop platforms) and to visit an attacker-controlled HTML page - user interaction is mandatory per CVSS UI:R. The attack is network-based (AV:N) with low complexity (AC:L) and requires no authentication from the attacker (PR:N). The vulnerability is specifically limited to the Signin UI component, meaning exploitation is most meaningful when the victim is expected to interact with a signin prompt. Limiting factors: iOS platform only; requires user to visit a crafted page; produces only UI deception (no code execution, no data exfiltration directly); Chrome version must be below 149.0.7827.53. |
| Impact | The composite risk signal is low. CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity attack requiring no privileges, but mandating user interaction and producing only limited integrity impact with no confidentiality or availability consequences. EPSS at 0.05% (15th percentile) strongly corroborates a low real-world exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified. Chromium's own severity classification is 'Low.' The integrity impact (I:L) is constrained to UI deception - specifically signin spoofing - rather than data exfiltration or code execution. Taken together, this is not a priority remediation item for most organizations, though iOS Chrome users who handle sensitive authentication flows should patch as part of routine browser update hygiene. No conflicting signals between CVSS and description are noted. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page on a remote server and entices an iOS Chrome user to visit it - via phishing link, malicious ad, or redirect chain. The page exploits the inappropriate Signin implementation to render a spoofed signin UI overlaying or mimicking a legitimate service, potentially harvesting credentials entered by the victim. No public exploit code exists for this scenario at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
UI spoofing in Google Chrome on iOS (prior to 149.0.7827.53) allows an unauthenticated remote attacker to present a deceptive interface to users by serving a crafted HTML page, specifically targeting the Signin flow. The root cause is an inappropriate implementation classified under CWE-20 (Improper Input Validation), meaning Chrome fails to sufficiently validate or constrain inputs that influence the rendered signin UI. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.05% (15th percentile) indicates very low near-term exploitation probability, consistent with the Low Chromium severity rating.
RemediationAI
Update Google Chrome on iOS to version 149.0.7827.53 or later, available through the Apple App Store. This is the vendor-released patch confirmed by the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No workarounds are documented for this specific flaw. As an interim measure for high-security environments, users can be instructed to manually verify the URL and certificate in the address bar before entering credentials on any signin page encountered while browsing, since this mitigates the practical impact of UI spoofing without requiring an immediate update. Enabling automatic app updates on iOS devices will ensure Chrome is kept current without manual intervention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Signin component of Google Chrome on iOS, distinct from the desktop Chromium codebase, implying platform-specific rendering or input-handling behavior on Apple's WebKit/iOS environment. CWE-20 (Improper Input Validation) as the root cause class indicates that attacker-controlled input - delivered via a crafted HTML page - is not adequately sanitized or constrained before influencing the signin UI rendering logic. This category of flaw frequently manifests as address bar spoofing, tab UI manipulation, or overlay abuse in mobile browsers, where OS-level constraints and browser chrome boundaries differ from desktop. The affected CPE scope is Google Chrome on iOS versions prior to 149.0.7827.53, as confirmed by the EUVD entry EUVD-2026-34741.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB