CVE-2026-14068: Google Chrome iOS XSS Vulnerability

CVE-2026-14068 Overview

CVE-2026-14068 is a Universal Cross-Site Scripting (UXSS) vulnerability affecting Google Chrome on iOS prior to version 150.0.7871.47. The flaw resides in the Omnibox component and stems from an inappropriate implementation that allows a remote attacker to inject arbitrary scripts or HTML into the context of another origin. Exploitation requires the attacker to convince a user to perform specific user interface gestures after visiting a crafted HTML page. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Google assigned this issue a Chromium security severity of Low, while the NVD rating is Medium.

Critical Impact
Successful exploitation lets an attacker execute arbitrary scripts or HTML in the context of a trusted origin, bypassing the same-origin policy and enabling session theft, credential harvesting, or content spoofing within the mobile browser.

Affected Products

Google Chrome on iOS prior to 150.0.7871.47
Apple iPhone OS (as the underlying platform for the affected browser build)
Any iOS device running a pre-patch version of Chrome

Discovery Timeline

2026-06-30 - CVE-2026-14068 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14068

Vulnerability Analysis

The vulnerability is a Universal Cross-Site Scripting (UXSS) flaw in the Chrome Omnibox on iOS. The Omnibox is the combined URL and search input bar and is a security-sensitive component because it renders and processes user-controllable strings that map to trusted browser origins. An inappropriate implementation in this component allows attacker-controlled HTML or JavaScript to be injected such that the injected content executes in the security context of a page the user did not intend to interact with.

Because the injection occurs at the browser UI boundary, the resulting script executes with the privileges of the target origin rather than the attacker's origin. This breaks the same-origin policy that isolates web content. The Chromium project categorized the underlying issue at Low severity, reflecting the required user interaction and the constrained impact per the CVSS vector.

Root Cause

The root cause is improper neutralization of input rendered or processed by the Omnibox component ([CWE-79]). Specific UI gestures triggered on a crafted page cause the browser to treat attacker-supplied content in a way that permits arbitrary script or HTML execution against another origin. The defect is specific to the iOS build of Chrome and is resolved in 150.0.7871.47.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and convinces a target to visit it, then coaxes the user into performing specific UI gestures such as tapping, long-pressing, or interacting with Omnibox elements. Once the gesture sequence is completed, the crafted content triggers script injection into a different origin. The scope change reflected in the CVSS vector (S:C) indicates the impact crosses the vulnerable component's security boundary, which is characteristic of UXSS.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-14068

Indicators of Compromise

Chrome for iOS clients reporting a version string earlier than 150.0.7871.47 in mobile device management (MDM) telemetry.
Mobile web traffic to unfamiliar domains immediately followed by anomalous outbound requests to trusted sites containing injected script fragments.
User reports of unexpected pop-ups, credential prompts, or content injected into the display of legitimate websites on iOS Chrome.

Detection Strategies

Inventory installed Chrome versions on managed iOS devices and flag any build earlier than 150.0.7871.47.
Inspect proxy and web gateway logs for HTML payloads containing suspicious Omnibox-targeting gesture triggers or obfuscated script tags served to iOS Chrome user agents.
Correlate user interaction with a suspicious page and subsequent authenticated actions on unrelated origins within the same browser session.

Monitoring Recommendations

Enable mobile threat defense telemetry to surface out-of-date Chrome installations across the fleet.
Monitor MDM compliance dashboards for Chrome auto-update health on iOS endpoints.
Track web filtering alerts for domains distributing UXSS proof-of-concept payloads once details become public.

How to Mitigate CVE-2026-14068

Immediate Actions Required

Update Google Chrome on iOS to version 150.0.7871.47 or later on all managed and personal devices.
Push a forced update policy through MDM to ensure iOS devices receive the patched App Store build.
Communicate to users that they should avoid interacting with unexpected UI prompts, especially gestures involving the address bar, on untrusted pages.

Patch Information

Google addressed the issue in Chrome for iOS 150.0.7871.47. Details are provided in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry. Apply the update through the Apple App Store or by pushing the update policy through enterprise mobility management.

Workarounds

Use an alternate iOS browser until Chrome can be updated, if immediate patching is not possible.
Restrict access to untrusted websites on managed iOS devices using a web filtering solution or secure web gateway.
Educate users to avoid unusual gesture sequences requested by web content, particularly those interacting with the address bar.

bash

# Verify Chrome for iOS build version via MDM query
# Example: query Chrome application version reported by iOS devices
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString
# Expected patched value: 150.0.7871.47 or later