CVE-2026-13917
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to convince a user to perform specific UI gestures, bypassing navigation restrictions via a crafted HTML page.
Risk Assessment
The risk involves bypassing navigation restrictions, potentially leading to unauthorized access to pages or data. The attack requires user interaction but can be exploited in phishing or social engineering campaigns.
Recommendation
Immediately update Chrome for iOS to version 150.0.7871.47 or later. Also advise users to avoid clicking suspicious links and performing unusual gestures on web pages.
Original NVD description (English source)
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)