CVE-2026-18013 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome for iOS deployments should assess exposure and prioritize updating to the fixed version. This includes verifying Chrome for iOS versions and ensuring users are updated to 151.0.7922.72 or later to prevent potential UI spoofing attacks. Additionally, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor

Why it matters

CVE-2026-18013 is a medium-severity UI spoofing vulnerability in Google Chrome for iOS. Defenders should prioritize verifying Chrome for iOS versions and ensuring users are updated to 151.0.7922.72 or later to prevent potential UI spoofing attacks.

• Attackers could exploit this vulnerability to perform UI spoofing, potentially leading to phishing or other malicious activities
• Defenders need to verify Chrome for iOS versions to ensure users are protected
• UI spoofing attacks could be used to trick users into revealing sensitive information

Technical summary

The vulnerability is caused by an inappropriate implementation in Chrome for iOS, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This issue affects Google Chrome for iOS versions prior to 151.0.7922.72. The vulnerability has a CVSS score of 4.3, indicating a medium severity. Defenders should prioritize verifying Chrome for iOS versions and ensuring users are updated to 151.0.7922.72 or later.

Defensive priority

Defenders should prioritize verifying Chrome for iOS versions and ensuring users are updated to 151.0.7922.72 or later.

Recommended defensive actions

• Verify Chrome for iOS versions and update to 151.0.7922.72 or later
• Monitor user interactions with untrusted HTML pages
• Implement additional security measures to detect and prevent UI spoofing attacks

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The official CVE Program record (CVE-2026-18013 CVE Program record) and NVD detail page (CVE-2026-18013 NVD vulnerability detail) offer source-provided CVE metadata and source-specific vulnerability assessments. The vulnerability affects Google Chrome for iOS prior to version 151.0.7922.72. Defenders should verify Chrome for iOS versions to ensure users are

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.