CVE-2026-13916 is a UI spoofing vulnerability in Google Chrome for iOS versions before 150.0.7871.47. The flaw arises from an inappropriate implementation in the browser that enables a remote attacker to craft HTML content that can spoof the user interface, potentially misleading users. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. There is no explicit vendor advisory detail on remediation level or patch availability in the provided data, but the affected version is indicated as prior to 150.0.7871.47, implying that version 150.0.7871.47 includes the fix.

The vulnerability allows remote attackers to perform UI spoofing, which can deceive users into believing they are interacting with legitimate browser UI elements when they are not. This can facilitate phishing or social engineering attacks but does not directly compromise data confidentiality or system availability.

Users should update Google Chrome on iOS to version 150.0.7871.47 or later, where this vulnerability is fixed. Since this is a client-side application vulnerability, applying the update is the recommended remediation. No additional vendor advisory details on temporary mitigations or workarounds are provided. Patch status is inferred from the affected version information; check the vendor advisory for confirmation.