CVE-2026-14068

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 150.0.7871.47

Description An improper implementation in the Omnibox allows a remote attacker to inject arbitrary scripts or HTML (Universal Cross-Site Scripting - UXSS) via a crafted HTML page. This occurs when a user is convinced to perform specific UI gestures. UXSS is a type of vulnerability that allows an attacker to execute scripts across different origins in the browser.

Recommendations Update Google Chrome on iOS to version 150.0.7871.47 or later.