CVE-2026-13812

MediumCVSS 4.7

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile — higher than 8% of all known CVEs

Summary

Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to convince a user to perform specific UI gestures, leading to arbitrary script or HTML injection (UXSS) via a crafted HTML page.

Risk Assessment

The risk involves a Universal XSS attack that could lead to session data theft, account takeover, or displaying fake content within trusted domain contexts.

Recommendation

Immediately update Google Chrome on iOS to version 150.0.7871.47 or later. Advise users to avoid clicking suspicious links and performing unusual gestures.

Original NVD description (English source)

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)