CVE-2026-13991: Google Chrome XSS Vulnerability

CVE-2026-13991 Overview

CVE-2026-13991 affects Google Chrome for iOS versions prior to 150.0.7871.47. The flaw stems from insufficient validation of untrusted input in the Chrome for iOS component. A remote attacker can perform user interface (UI) spoofing by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Medium, and the vulnerability maps to [CWE-20] Improper Input Validation.

The issue requires user interaction, such as visiting an attacker-controlled page, and does not permit code execution or data theft directly. Instead, it enables deceptive rendering that can support phishing and social engineering attacks against mobile users.

Critical Impact
A remote attacker can spoof browser UI elements in Chrome for iOS to deceive users into trusting malicious content, enabling credential theft and phishing attacks.

Affected Products

Google Chrome for iOS prior to 150.0.7871.47
Apple iOS devices running vulnerable Chrome builds
Any iPhone or iPad with Chrome installed before the fixed version

Discovery Timeline

2026-06-30 - CVE-2026-13991 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13991

Vulnerability Analysis

CVE-2026-13991 is a UI spoofing vulnerability in Google Chrome for iOS. The browser fails to properly validate untrusted input processed during HTML page rendering. An attacker crafts an HTML page that manipulates browser chrome elements such as the address bar, security indicators, or overlay UI.

The attack requires the victim to load the malicious page. Once loaded, the crafted content abuses rendering assumptions specific to Chrome's iOS implementation, which relies on Apple's WebKit engine under App Store policy. The result is a mismatch between what the user sees and the actual origin of displayed content.

The vulnerability does not grant confidentiality or availability impact. Its value to attackers lies in supporting downstream social engineering, particularly credential harvesting against mobile users who rely on visible URL and security indicators to assess trust.

Root Cause

The root cause is improper input validation within Chrome for iOS UI handling code. Specific implementation details are tracked in the Chromium Issue Tracker Entry. The component does not sufficiently sanitize or constrain content that influences visible browser interface state.

Attack Vector

Exploitation occurs over the network. An attacker hosts a crafted HTML page and lures the victim to visit it through phishing links, malvertising, or compromised sites. When the victim opens the URL in a vulnerable Chrome for iOS build, the page manipulates UI rendering to impersonate legitimate sites or system prompts.

No authentication is required, and no exploit code is publicly available at the time of publication. See the Google Chrome Update Blog for vendor details.

Detection Methods for CVE-2026-13991

Indicators of Compromise

User reports of Chrome for iOS pages that appear to display trusted domains but contain unexpected login prompts or credential forms
Outbound traffic from iOS devices to newly registered domains hosting HTML pages that mimic banking, corporate SSO, or Google login interfaces
Chrome for iOS builds below 150.0.7871.47 observed in mobile device management (MDM) inventory reports

Detection Strategies

Query MDM and mobile threat defense telemetry for Chrome for iOS versions older than 150.0.7871.47 across the managed fleet
Correlate proxy or DNS logs against threat intelligence feeds tracking phishing infrastructure targeting iOS Chrome users
Monitor identity provider logs for anomalous authentication attempts from mobile Chrome user agents shortly after users click external links

Monitoring Recommendations

Track Chrome for iOS version distribution in endpoint inventory and flag devices running builds prior to the patched release
Ingest mobile browser telemetry and identity provider events into a centralized SIEM to detect credential submission anomalies
Alert on Chrome for iOS traffic to domains with low reputation scores or recently issued certificates

How to Mitigate CVE-2026-13991

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store on all managed devices
Push forced application updates via MDM policies to accelerate patch adoption across the mobile fleet
Notify users of active phishing campaigns leveraging mobile browser UI spoofing and reinforce URL verification practices

Patch Information

Google addressed CVE-2026-13991 in Chrome for iOS 150.0.7871.47. Users should install the update directly from the Apple App Store. Full release information is available in the Google Chrome Update Blog.

Workarounds

Restrict Chrome for iOS usage until updates are applied and default users to Safari or another patched browser through MDM configuration
Enable phishing-resistant multi-factor authentication such as FIDO2 hardware keys or platform authenticators to reduce the impact of successful UI spoofing
Deploy DNS filtering and secure web gateway policies on mobile devices to block known phishing domains

bash

# Example MDM query to identify vulnerable Chrome for iOS versions
# Replace with the syntax appropriate for your MDM platform
mdm-cli query --app "com.google.chrome.ios" \
  --version-less-than "150.0.7871.47" \
  --output devices-to-patch.csv