This vulnerability (CVE-2026-13907) affects Google Chrome on iOS versions before 150.0.7871.47. It arises from an inappropriate implementation in the iOSWeb component, enabling a remote attacker to conduct UI spoofing attacks. The attack requires user interaction via specific UI gestures on a maliciously crafted HTML page. The CVSS v3.1 base score is 4.2 (Medium), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. There is no vendor advisory explicitly stating a patch or remediation level, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. This can lead to integrity and availability impacts, but no confidentiality loss is indicated. Exploitation requires user interaction and has a high attack complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided vendor advisory link does not explicitly confirm a fix or remediation level. Users should update to version 150.0.7871.47 or later once confirmed by the vendor. Until then, caution with untrusted web content and avoiding suspicious UI gestures may reduce risk.