EUVD-2026-30405
GHSA-f8mq-ccrq-xvwx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
AV:N and AC:H reflect web delivery requiring prior renderer compromise; UI spoofing warrants I:L over I:N; no availability impact applies to UI misrepresentation.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome on iOS (prior to 148.0.7778.168) enables a remote attacker - who has already compromised the renderer process - to manipulate browser interface elements via a crafted HTML page, potentially deceiving users into accepting false security prompts or disclosing information to spoofed dialogs. This is a chained, post-renderer-compromise technique classified CWE-451 (UI Misrepresentation of Critical Information), rated Medium by Google with CVSS 4.2. No public exploit code exists, EPSS stands at 0.06% (18th percentile), and CISA SSVC confirms no active exploitation, placing real-world risk well below the theoretical ceiling implied by the network attack vector.
Technical ContextAI
The vulnerability resides in Chrome's Views component - the cross-platform UI rendering framework - as implemented specifically on iOS. CWE-451 describes failures where an application misrepresents critical information in its user interface, and here the inappropriate implementation allows a compromised renderer to influence how trusted UI elements (such as address bar content, permission dialogs, or security indicators) are drawn or overlaid. On iOS, Chrome operates under Apple's WebKit-adjacent rendering constraints, and the divergence from desktop Views behavior appears to introduce this platform-specific flaw. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped by the description to iOS deployments only, prior to version 148.0.7778.168. The root cause is not a memory-safety issue but a logic flaw in how renderer-controlled content can interact with trusted browser chrome.
RemediationAI
Update Google Chrome on iOS to version 148.0.7778.168 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Users should ensure automatic updates are enabled in the iOS App Store settings for Chrome. Because exploitation requires prior renderer compromise, organizations with iOS device fleets should also ensure their Mobile Device Management (MDM) policies enforce prompt Chrome updates and consider restricting access to untrusted or high-risk web content via enterprise content filtering - this reduces the likelihood of the renderer compromise precondition being met in the first place. No specific workaround is documented by Google for this issue, and disabling the Views-based UI would not be a practical compensating control.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today