CVE-2026-13917
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to convince a user to perform specific UI gestures, bypassing navigation restrictions via a crafted HTML page.
Risk Assessment
The risk involves bypassing navigation restrictions, potentially leading to unauthorized access to pages or data. The attack requires user interaction but can be exploited in phishing or social engineering campaigns.
Recommendation
Immediately update Chrome for iOS to version 150.0.7871.47 or later. Also advise users to avoid clicking suspicious links and performing unusual gestures on web pages.
Other vulnerabilities in Chrome for iOS
See all- CVE-2026-13843Critical
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-14128Medium
An inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The issue stems from improper handling in the browser.
- CVE-2026-13981Medium
An inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from a flaw in the browser's implementation.
- CVE-2026-13916Medium
An inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from a flaw in the browser's implementation.
- CVE-2026-13902Medium
A vulnerability in Google Chrome on iOS prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from inappropriate implementation in the Chrome for iOS component.
- CVE-2026-13847Medium
Insufficient validation of untrusted input in Chrome for iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- CVE-2026-13842Medium
A vulnerability in Google Chrome on iOS prior to version 150.0.7871.47 allows a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The issue is due to inappropriate implementation in the Chrome for iOS component.
Original NVD description (English source)
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)