CVE-2026-13907

MediumCVSS 4.2

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile — higher than 11% of all known CVEs

Summary

An inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page by convincing a user to engage in specific UI gestures.

Risk Assessment

The risk involves UI spoofing attacks that could lead to data theft or tricking users into unintended actions, undermining trust in the browser interface.

Recommendation

It is recommended to immediately update Google Chrome on iOS to version 150.0.7871.47 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)