CVE-2026-13983 is an incorrect security UI vulnerability in Google Chrome for iOS versions before 150.0.7871.47. It allows a remote attacker to spoof the Omnibox contents by convincing a user to perform specific UI gestures on a maliciously crafted HTML page. The flaw relates to improper UI implementation, categorized under CWE-451 (Incorrect Expression of User Interface). The CVSS 3.1 base score is 4.2, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability enables an attacker to spoof the URL bar, potentially misleading users about the website they are visiting. This could facilitate phishing or social engineering attacks by presenting a deceptive URL. However, there is no direct confidentiality impact, and integrity and availability impacts are low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, exercise caution with untrusted web content and avoid performing unusual UI gestures prompted by websites.