CVE-2026-14136
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to perform UI spoofing via a crafted HTML page.
Risk Assessment
An attacker can trick the user by displaying a fake browser interface, potentially leading to theft of login credentials or other sensitive information.
Recommendation
Immediately update Google Chrome on iOS to version 150.0.7871.47 or later.
Other vulnerabilities in Chromium
See all- CVE-2026-79223High
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Severity: Low)
- CVE-2026-13799High
A use-after-free vulnerability in QUIC in Google Chrome prior to 150.0.7871.47 allows a remote attacker to potentially exploit heap corruption via malicious network traffic.
Original NVD description (English source)
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)