CVE-2026-13912 Overview
CVE-2026-13912 is a user interface (UI) spoofing vulnerability in the Safe Browsing component of Google Chrome on iOS prior to version 150.0.7871.47. The flaw stems from an inappropriate implementation that a remote attacker can abuse via a crafted HTML page to misrepresent security indicators or content within the browser UI. Google assigned this issue a Chromium security severity of Medium. The vulnerability is classified under [CWE-451] (User Interface Misrepresentation of Critical Information).
Critical Impact
A remote attacker can spoof UI elements in Chrome for iOS through a crafted HTML page, enabling phishing and social engineering attacks that trick users into trusting malicious content.
Affected Products
- Google Chrome for iOS versions prior to 150.0.7871.47
- iOS devices running vulnerable Chrome builds
- Web sessions handled by the Safe Browsing component in Chrome on iOS
Discovery Timeline
- 2026-06-30 - CVE-2026-13912 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13912
Vulnerability Analysis
CVE-2026-13912 resides in the Safe Browsing implementation shipped with Chrome for iOS. Safe Browsing is designed to warn users about deceptive sites, malicious downloads, and unwanted software. The inappropriate implementation allows an attacker-controlled HTML page to manipulate how the browser presents security-relevant UI elements to the user. The result is a UI spoofing condition that undermines the trust signals users rely on when evaluating a page.
The vulnerability requires user interaction, typically visiting a crafted page. It does not grant code execution or direct access to user data. Instead, it enables the attacker to mislead the user, which is often a precursor to credential theft or malware delivery through follow-on social engineering.
An EPSS score of 0.204% places this issue in a low-probability band for near-term exploitation, but browser UI spoofing bugs are frequently combined with phishing campaigns.
Root Cause
The root cause is an inappropriate implementation within Chrome's iOS Safe Browsing code path. Under specific conditions triggered by attacker-controlled HTML, the browser renders or updates UI elements in a manner inconsistent with the actual security state of the page. This mismatch is the defining pattern of [CWE-451].
Attack Vector
Exploitation is remote and occurs over the network. An attacker hosts a crafted HTML page and lures a Chrome for iOS user to visit it. When the page loads, it triggers the flawed Safe Browsing logic to display misleading UI. The attacker does not need prior authentication or elevated privileges. Only user interaction, in the form of navigating to the attacker's page, is required.
No verified public exploit code is available. The vulnerability mechanism is described in the Google Chrome Update Notice and the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-13912
Indicators of Compromise
- Chrome for iOS clients reporting version strings below 150.0.7871.47 in web server logs or MDM inventory.
- User reports of Chrome on iOS displaying inconsistent address bar, security indicator, or Safe Browsing warnings on specific pages.
- Outbound navigation to newly registered or low-reputation domains delivering HTML content designed to imitate trusted brands.
Detection Strategies
- Inventory Chrome for iOS versions across the mobile fleet and flag any device below 150.0.7871.47.
- Correlate phishing-related URL categories with mobile Chrome user-agent strings in web proxy or secure web gateway logs.
- Monitor threat intelligence feeds for phishing kits that specifically target Chrome for iOS UI rendering.
Monitoring Recommendations
- Ingest mobile browser version telemetry from mobile device management (MDM) platforms into the security data lake for continuous version tracking.
- Alert on user-reported phishing incidents originating from mobile Chrome sessions.
- Track DNS and HTTP telemetry for high-frequency access to domains impersonating internal login portals from iOS devices.
How to Mitigate CVE-2026-13912
Immediate Actions Required
- Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store.
- Enforce automatic app updates on managed iOS devices using MDM configuration profiles.
- Communicate the issue to end users and reinforce guidance on verifying URLs and security indicators before entering credentials.
Patch Information
Google addressed the issue in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Update Notice and the Chromium Issue Tracker Entry. No workaround replaces installation of the patched version.
Workarounds
- Restrict Chrome for iOS on managed devices until the patched version is deployed, using an alternate browser configured through MDM.
- Enable enterprise phishing protection at the network layer via secure web gateway or DNS filtering to reduce exposure to crafted HTML pages.
- Reinforce user training on identifying phishing pages and reporting suspicious browser behavior on mobile devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
