The vulnerability CVE-2026-14068 involves an inappropriate implementation in the Omnibox feature of Google Chrome on iOS prior to version 150.0.7871.47. This flaw enables a remote attacker to exploit user interaction with specific UI gestures on a maliciously crafted HTML page to perform cross-site scripting (UXSS) attacks by injecting arbitrary scripts or HTML. The issue is classified with low severity by Chromium security. The published information does not include a CVSS score or explicit remediation details, though a vendor advisory URL is provided.

Successful exploitation allows an attacker to inject arbitrary scripts or HTML into the browser context via user interaction, potentially leading to UXSS attacks. This could result in unauthorized script execution within the browser session, but the severity is rated low by the vendor. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update Google Chrome on iOS to version 150.0.7871.47 or later once confirmed to be fixed. Until then, caution is advised when interacting with untrusted web content that may attempt to exploit UI gestures.