CVE-2026-13842 is an incorrect security UI vulnerability in Google Chrome for iOS versions before 150.0.7871.47. It allows a remote attacker to craft an HTML page that spoofs the Omnibox URL bar, potentially misleading users about the true destination of a link. The vulnerability is recognized as CWE-451 and has a medium severity impact with no known exploits in the wild. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

The vulnerability enables remote attackers to spoof the URL displayed in the Omnibox on affected Chrome for iOS versions, potentially deceiving users into believing they are visiting a legitimate website when they are not. This can facilitate phishing or social engineering attacks. There is no direct confidentiality or availability impact reported.

A fixed version is available: users should update Google Chrome for iOS to version 150.0.7871.47 or later. Since the vendor advisory URL is provided but does not explicitly state patch status in the input, users should verify the update status via the official Chrome release blog. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.