CVE-2026-14143 Overview
CVE-2026-14143 is a user interface spoofing vulnerability in the Passwords component of Google Chrome on iOS. Versions prior to 150.0.7871.47 contain an incorrect security UI implementation [CWE-451] that allows a remote attacker to spoof security indicators through a crafted HTML page. Successful exploitation requires user interaction with the malicious page. The flaw affects the trust signals users rely on when interacting with saved passwords, enabling phishing and credential-theft workflows against iOS Chrome users.
Critical Impact
A crafted web page can render deceptive security UI within Chrome's Passwords surface on iOS, tricking users into disclosing credentials or trusting attacker-controlled content.
Affected Products
- Google Chrome on iOS prior to 150.0.7871.47
- Apple iPhone OS (Chrome browser installations)
- Any iOS device running vulnerable Chrome builds
Discovery Timeline
- 2026-06-30 - CVE-2026-14143 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-14143
Vulnerability Analysis
The vulnerability is classified as an incorrect security UI issue [CWE-451] in the Passwords feature of Chrome for iOS. Chrome renders security-relevant UI elements when users interact with stored password data. A crafted HTML page can manipulate the rendering context so that the security indicators presented to the user do not match the underlying origin or content.
The attack is remote and requires only that a victim visit a malicious page in a vulnerable Chrome build. No authentication or elevated privileges are required to initiate the attack. Chromium maintainers rated the underlying security severity as Low, reflecting limited integrity impact and the requirement for user interaction.
The issue does not enable direct code execution or memory corruption. Instead, it undermines the visual trust signals users depend on when Chrome exposes saved-password functionality, expanding the attack surface for credential phishing on iOS.
Root Cause
The root cause is improper handling of UI state within the Passwords surface on iOS, allowing attacker-controlled HTML to influence what should be a trusted, browser-owned display. Because iOS Chrome relies on WebKit, security-critical UI must be rendered outside the reach of page content. This flaw indicates that boundary was not correctly enforced in versions prior to 150.0.7871.47.
Attack Vector
An attacker hosts a crafted HTML page and lures a Chrome-on-iOS user to visit it via phishing links, malvertising, or compromised sites. When the user interacts with the page, Chrome's Passwords UI is rendered in a misleading state, potentially presenting attacker content as if it were a trusted browser dialog. Users may then submit credentials or approve actions they believe are handled by Chrome. See the Chromium Issue Tracker Entry for additional context.
Detection Methods for CVE-2026-14143
Indicators of Compromise
- Mobile device management (MDM) telemetry reporting Chrome for iOS versions below 150.0.7871.47
- User reports of unexpected password prompts, autofill dialogs, or security banners on untrusted sites
- Web proxy logs showing visits to newly registered domains hosting credential-harvesting HTML forms
Detection Strategies
- Inventory installed Chrome versions on managed iOS fleets and flag builds prior to 150.0.7871.47
- Correlate phishing report submissions from end users with browser and OS metadata to identify Chrome on iOS exposure
- Monitor DNS and proxy logs for domains that impersonate authentication portals or password manager interfaces
Monitoring Recommendations
- Track Chrome for iOS version distribution through MDM compliance dashboards
- Enable phishing URL feeds within the corporate web proxy or secure web gateway
- Alert on credential submission events from mobile browsers to domains outside the approved single sign-on set
How to Mitigate CVE-2026-14143
Immediate Actions Required
- Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store
- Push forced update policies via MDM to ensure managed iOS devices receive the fixed Chrome build
- Communicate phishing awareness guidance to users, emphasizing scrutiny of password prompts inside mobile browsers
Patch Information
Google addressed the issue in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Update Announcement and the associated Chromium Issue Tracker Entry. Apply the update across all iOS devices in scope. No configuration changes are required after the update.
Workarounds
- Use an alternative up-to-date browser on iOS until Chrome can be updated on affected devices
- Disable Chrome password autofill on iOS through browser settings to reduce exposure to spoofed password UI
- Restrict access to sensitive web applications from unmanaged mobile devices via conditional access policies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
