CVE-2026-13902
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
An inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from improper handling in the browser.
Risk Assessment
An attacker can trick users by displaying fake dialog boxes or address bars, potentially leading to theft of login credentials or other sensitive information.
Recommendation
Immediately update Chrome for iOS to version 150.0.7871.47 or later. Users should also exercise caution when clicking on suspicious links.
Original NVD description (English source)
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)