CVE-2026-14123 Overview
CVE-2026-14123 is an incorrect security UI vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. A remote attacker can spoof the contents of the Omnibox (URL bar) by serving a crafted HTML page. The flaw is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information) and carries a CVSS 3.1 score of 4.3. Chromium's internal security team rated the issue Low severity. Successful exploitation requires user interaction, such as visiting an attacker-controlled page. The vulnerability enables phishing scenarios where users cannot rely on the URL bar to verify site authenticity.
Critical Impact
Attackers can display a misleading URL in the Chrome for iOS Omnibox, undermining a core trust indicator that users depend on to identify legitimate websites.
Affected Products
- Google Chrome for iOS versions prior to 150.0.7871.47
- Apple iOS devices running vulnerable Chrome builds
- Any workflow that relies on the Omnibox for site identity verification
Discovery Timeline
- 2026-06-30 - CVE-2026-14123 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-14123
Vulnerability Analysis
The vulnerability resides in Chrome for iOS's rendering of the Omnibox during specific navigation states. A crafted HTML page can manipulate the URL displayed to the user while the underlying document origin differs from what the Omnibox shows. This mismatch between displayed and actual origin creates a spoofing primitive suitable for phishing.
The issue falls under [CWE-451], where security-relevant information is misrepresented to the user. Unlike memory corruption bugs, no code execution occurs. The attack targets the human trust boundary rather than the browser process. Confidentiality is not directly impacted, but integrity of security indicators is compromised.
Root Cause
The root cause is improper handling of URL display logic in Chrome for iOS when specific HTML content triggers navigation or history manipulation. The browser updates the Omnibox to reflect an attacker-chosen URL before, or without, loading content from that origin. Because iOS Chrome uses WKWebView with additional Chromium logic layered on top, URL synchronization between the web view and the browser chrome must be tightly coupled. A deviation in that synchronization enables the spoof.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim into visiting it through phishing, malvertising, or a compromised site. Once loaded, the page manipulates the Omnibox to display a trusted domain such as a bank or SaaS login page. The victim then submits credentials or sensitive data believing they are on the legitimate site. Because the attack is purely client-side and produces no unusual network signatures, it is difficult to identify with network monitoring alone.
The vulnerability manifests through URL bar manipulation techniques described in the Chromium Issue Tracker Entry. No public proof-of-concept has been published, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-14123
Indicators of Compromise
- Chrome for iOS installations reporting versions earlier than 150.0.7871.47 in mobile device management (MDM) inventory
- User reports of URL bars displaying trusted domains on pages with unexpected content or layout
- Phishing pages served over HTTPS whose landing HTML contains navigation manipulation targeting mobile Safari or WKWebView engines
Detection Strategies
- Query MDM and endpoint inventory data for Chrome iOS versions below 150.0.7871.47 and flag noncompliant devices
- Correlate credential submission events in identity providers with referrer or user-agent data indicating mobile Chrome sessions to unfamiliar hosts
- Ingest browser telemetry into a SIEM to detect anomalous navigation sequences originating from mobile Chrome clients
Monitoring Recommendations
- Track Chrome for iOS version distribution across the fleet and alert when devices remain below the patched build after the update window closes
- Monitor authentication logs for successful logins from mobile devices immediately following visits to newly registered or low-reputation domains
- Enable phishing-resistant multi-factor authentication (MFA) enforcement and log any fallback authentication attempts for review
How to Mitigate CVE-2026-14123
Immediate Actions Required
- Update Google Chrome for iOS to version 150.0.7871.47 or later on all managed devices
- Push the update through MDM policy to enforce compliance on corporate-owned and BYOD endpoints
- Communicate the risk to end users and instruct them to verify URLs through bookmarks rather than typing or clicking untrusted links
Patch Information
Google addressed the vulnerability in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Update Announcement. Devices receive the update through the Apple App Store, and MDM administrators should confirm automatic app updates are enabled for managed Chrome deployments.
Workarounds
- Restrict use of Chrome for iOS on unpatched devices and direct users to an alternative browser until the update is applied
- Enforce phishing-resistant authentication such as FIDO2 or WebAuthn to reduce the value of any spoofed credential entry page
- Deploy secure web gateway or DNS filtering to block known phishing domains that may be used in exploitation attempts
# Verify installed Chrome iOS version via MDM query (example: Jamf)
# Devices reporting versions below 150.0.7871.47 require remediation
jamf policy -event update-chrome-ios
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
