EUVD-2026-40593
GHSA-v68w-64jw-rfjj
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack delivered via crafted network page (AV:N) but requires specific gesture sequence (AC:H); no attacker auth needed (PR:N); active user participation mandatory (UI:R); impact limited to UI deception affecting integrity and minor availability, no data disclosure.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's iOSWeb component on iOS allows remote attackers to misrepresent interface elements to users running versions prior to 150.0.7871.47. The vulnerability, rooted in an inappropriate implementation (CWE-451), is triggered when a user performs specific UI gestures on a crafted HTML page, enabling spoofing of security-critical browser interface elements such as the address bar or permission dialogs. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity and mandatory user interaction meaningfully constrain real-world risk.
Technical ContextAI
The iOSWeb component is Google Chrome's iOS-specific web rendering and UI layer, architecturally distinct from the desktop Chromium stack because Apple's platform policy mandates use of the WebKit engine on iOS. CWE-451 (User Interface Misrepresentation of Critical Information) describes root-cause flaws where a product's UI inaccurately represents security-critical state, enabling deception attacks. In this case, an inappropriate implementation in iOSWeb allows a crafted HTML page, in combination with attacker-directed user gestures, to manipulate how the browser renders or presents interface chrome - potentially deceiving users about content origin, security posture, or permission grants. Per EUVD-2026-40593, the affected version range is Chrome on iOS below 150.0.7871.47; other platforms are not referenced as affected.
RemediationAI
Vendor-released patch: Chrome 150.0.7871.47 for iOS. Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the primary and definitive fix per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No configuration-level workaround fully mitigates the spoofing risk, as the flaw is in the browser's iOSWeb implementation itself. As a partial compensating control pending patch deployment, users can be instructed to avoid interacting with unexpected gesture prompts from unfamiliar web pages and to verify URLs through the iOS Share sheet rather than relying solely on browser UI - though this does not eliminate the underlying vulnerability and should not substitute for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today