CVE-2026-13842 is a security vulnerability in Google Chrome for iOS where an attacker can craft an HTML page that spoofs the Omnibox (URL bar) content. This incorrect security UI implementation could deceive users into believing they are visiting a legitimate site when they are not. The vulnerability affects Chrome on iOS versions prior to 150.0.7871.47. The Chromium security team rates this issue as high severity. No CVSS score or explicit remediation level is provided in the available data. The vendor advisory URL is provided but does not explicitly confirm patch status in the input.

The vulnerability allows remote attackers to spoof the URL displayed in the Omnibox on Chrome for iOS, potentially misleading users about the authenticity of the website they are visiting. This could facilitate phishing or other social engineering attacks by making malicious sites appear legitimate. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to Chrome for iOS version 150.0.7871.47 or later once available. Until then, exercise caution when interacting with URLs and avoid clicking suspicious links.