CVE-2026-14128: Google Chrome XSS Vulnerability

CVE-2026-14128 Overview

CVE-2026-14128 is a URL bar spoofing vulnerability affecting Google Chrome for iOS versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation in Chrome for iOS that allows a remote attacker to spoof the contents of the Omnibox (URL bar) through a crafted HTML page. This weakness is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information). Successful exploitation requires user interaction, typically visiting an attacker-controlled webpage. The vulnerability enables phishing scenarios where users see a legitimate URL in the address bar while viewing attacker-controlled content.

Critical Impact
Attackers can display a spoofed URL in the Chrome Omnibox on iOS, enabling convincing phishing attacks against users who rely on the address bar to verify site authenticity.

Affected Products

Google Chrome for iOS versions prior to 150.0.7871.47
Apple iPhone OS devices running vulnerable Chrome builds
iPad devices running vulnerable Chrome for iOS builds

Discovery Timeline

2026-06-30 - CVE-2026-14128 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14128

Vulnerability Analysis

The vulnerability resides in how Chrome for iOS renders and updates the Omnibox during navigation events initiated by a crafted HTML page. A malicious page can manipulate navigation timing or JavaScript-driven state changes such that the address bar displays a URL that does not match the actual origin serving the content. Chromium rates this issue as low severity, reflecting the limited direct impact on confidentiality and availability. However, address bar spoofing weaknesses materially increase phishing efficacy, since the URL bar is the primary trust indicator on mobile browsers where certificate details and full URLs are typically truncated. The EPSS probability score is 0.179%, placing exploitation likelihood in the lower percentile range.

Root Cause

The root cause is an inappropriate implementation within the iOS-specific Chrome navigation and Omnibox rendering logic. Chrome for iOS uses WKWebView as required by Apple platform policy, and the browser must synchronize URL state between WKWebView and its own UI. A crafted HTML page can exploit gaps in this synchronization to desynchronize the displayed URL from the actual document origin.

Attack Vector

Exploitation requires a user to load an attacker-controlled HTML page in Chrome for iOS. The attacker crafts JavaScript or navigation sequences that trigger the desync condition, causing the Omnibox to display an arbitrary URL of the attacker's choosing while the page continues to serve attacker content. This is typically chained with phishing pages that mimic banking, corporate SSO, or webmail login flows. No authentication or elevated privileges are required on the target device. The vulnerability manifests in the Omnibox update path for iOS builds; refer to the Chromium Issue Report #514015836 for developer-level detail.

Detection Methods for CVE-2026-14128

Indicators of Compromise

Chrome for iOS builds reporting a version string below 150.0.7871.47 in mobile device management (MDM) inventory.
User reports of URL bar contents that do not match the visible page contents or expected destination.
Web proxy logs showing iOS Chrome user agents connecting to newly registered domains hosting cloned login pages.

Detection Strategies

Query MDM and unified endpoint management platforms for installed Chrome for iOS versions and flag any below 150.0.7871.47.
Correlate phishing report submissions from users with device browser telemetry to identify iOS Chrome sessions preceding credential compromise.
Inspect network telemetry for suspicious redirects and short-lived HTML pages served to iOS Chrome user agents.

Monitoring Recommendations

Track Chrome for iOS version compliance through mobile device inventory dashboards and alert on out-of-date installations.
Monitor identity provider logs for anomalous logins from mobile Safari-like user agents following visits to unclassified URLs.
Enable URL filtering and phishing-category blocking at the DNS or secure web gateway layer for mobile devices.

How to Mitigate CVE-2026-14128

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store on all managed and unmanaged devices.
Push a forced update policy via MDM to accelerate deployment across the mobile fleet.
Communicate phishing awareness guidance to users, emphasizing verification of destination beyond the URL bar during this window.

Patch Information

Google released the fix in the Chrome for iOS stable channel update covering versions 150.0.7871.47 and later. Refer to the Google Chrome Stable Update announcement for release details and the Chromium Issue Report #514015836 for the underlying tracker.

Workarounds

Direct iOS users to alternative browsers with current security updates until Chrome for iOS is patched on the device.
Enforce multi-factor authentication on all corporate identity providers to reduce impact of successful phishing attempts.
Deploy secure web gateway policies that block access to newly registered domains and known phishing infrastructure from mobile devices.

bash

# Configuration example - verify Chrome for iOS version compliance via MDM query
# Example: Microsoft Intune / Jamf inventory filter
Application.BundleID == "com.google.chrome.ios" AND Application.Version < "150.0.7871.47"