CVE-2026-14137
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk7th percentile — higher than 7% of all known CVEs
Summary
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page, provided the user was convinced to engage in specific UI gestures.
Risk Assessment
The risk involves potential user deception through a spoofed interface, which could lead to disclosure of sensitive information or unintended actions. The vulnerability is rated as Low severity by Chromium.
Recommendation
It is recommended to immediately update Chrome on iOS to version 150.0.7871.47 or later. Users should be advised about the risks of clicking suspicious links and performing unusual gestures.
Original NVD description (English source)
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)