CVE-2026-14068
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
An inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker, after convincing a user to perform specific UI gestures, to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Risk Assessment
The risk involves a Universal XSS attack, which could lead to session data theft, page content manipulation, or further escalation to other applications.
Recommendation
Immediately update Google Chrome on iOS to version 150.0.7871.47 or later, and advise users to avoid clicking suspicious links and performing unusual gestures.
Original NVD description (English source)
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)