CVE-2026-13902 is a UI spoofing vulnerability in Google Chrome on iOS prior to version 150.0.7871.47. The flaw stems from an inappropriate implementation that enables a remote attacker to craft HTML content that can spoof the browser's user interface, potentially misleading users. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. There is no explicit vendor advisory statement confirming a fix, and no known exploits have been reported.

The vulnerability allows remote attackers to perform UI spoofing, which can deceive users into interacting with malicious content under false pretenses. This may lead to limited integrity impact but does not affect confidentiality or availability. Since user interaction is required, exploitation depends on user actions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed. Until then, exercise caution when interacting with untrusted web content on Chrome for iOS.