EUVD-2026-40602
GHSA-8pxr-938v-9xff
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered UI spoofing via crafted HTML requires user to visit the page (UI:R, PR:N); visual deception yields only limited integrity impact with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Technical ContextAI
CWE-451 ('User Interface Misrepresentation of Critical Information') describes a class of flaws where an application fails to accurately present security-critical context to the user - in this case, how Chrome for iOS renders or responds to specific HTML constructs in a way that manipulates visible browser UI elements. Unlike desktop Chrome, which uses Google's Blink rendering engine, Chrome on iOS is constrained by Apple App Store policy to use WebKit for page rendering, meaning this flaw is specific to the iOS implementation layer - likely in Chrome's own UI chrome (address bar, security badges, navigation indicators) rather than in WebKit itself. The 'inappropriate implementation' descriptor points to a logic flaw in how Chrome for iOS interprets certain HTML or CSS inputs to produce misleading visual output, rather than a memory corruption issue. The unchanged scope (S:U) confirms the attack is fully contained within the browser process and cannot escape to the underlying iOS operating system. The Chromium issue tracker entry at https://issues.chromium.org/issues/508283108 may contain additional technical detail, though it is typically restricted prior to patch propagation.
RemediationAI
The primary fix is upgrading Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. The Google Chrome Releases blog at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html confirms the patched release. If an immediate update cannot be applied - for example, in managed device environments with delayed app approvals - compensating controls include instructing iOS Chrome users to manually verify the full URL in the address bar before submitting credentials, enforcing phishing-resistant MFA on sensitive applications so credential theft via spoofed UI is insufficient for account compromise, and considering temporary redirection of sensitive workflows to Safari on iOS, which is unaffected. The trade-off of these workarounds is reliance on user behavior rather than a technical control; the patch is the only complete remediation.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today