{"id":"CVE-2026-121186","kind":"vulnerability","aliases":["CVE-2026-121186"],"related":[],"title":"Chrome on iOS: crafted page can spoof Passwords dialog elements","description":"UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","summary":"A crafted HTML page can make fake interface elements appear in Passwords in Google Chrome on iOS, so a user may be tricked into social engineering actions. The sources rate the Chromium security severity as Medium and describe social engineering as a requirement.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chrome","ios","other","passwords"],"not_affected_if":["chrome-updated","non-ios-platforms"],"how_to_check":"- Check the Chrome version on the iPhone or iPad under Chrome > Settings > Google Chrome > About Chrome (unknown if the sources give this path; the version to compare is in the fix section).\n- Compare the installed version against `157.0.8103.38`.","fix":"- Google Chrome on iOS: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:27+00:00","first_seen_at":"2026-11-03T21:19:25+00:00","triaged_at":"2026-11-03T21:23:03+00:00","updated_at":"2026-11-03T21:23:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T21:23:03Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on iOS: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome on iOS: crafted page can spoof Passwords dialog elements","impact":"low","summary":"A crafted HTML page can make fake interface elements appear in Passwords in Google Chrome on iOS, so a user may be tricked into social engineering actions. The sources rate the Chromium security severity as Medium and describe social engineering as a requirement.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","ios","passwords"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker spoofs interface elements to trick a user into harmful actions","analyst_note":"","how_to_check":"- Check the Chrome version on the iPhone or iPad under Chrome > Settings > Google Chrome > About Chrome (unknown if the sources give this path; the version to compare is in the fix section).\n- Compare the installed version against `157.0.8103.38`.","plain_action":"Update Google Chrome on your iPhone or iPad to version 157.0.8103.38 or later.","needs_analyst":false,"not_affected_if":["chrome-updated","non-ios-platforms"],"who_is_affected":"People who use Google Chrome on iOS with the Passwords feature and who open a crafted HTML page, typically after being socially engineered into visiting it. Businesses managing iOS devices should check Chrome versions on managed devices. Devices on Chrome versions at or above 157.0.8103.38 are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4114,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121186':13A,16A '-2026':12A,15A '157.0.8103.38':76C 'action':47B 'allow':77C 'appear':30B 'attack':80C 'chrome':1A,17B,35B,70C 'chromium':52B,93C 'craft':4A,22B,90C 'cve':11A,14A 'describ':58B 'dialog':9A 'element':10A,29B,87C 'engin':46B,60B,83C 'fake':27B 'googl':34B,69C 'html':23B,91C 'interfac':28B 'io':3A,18B,37B,73C 'leverag':81C 'make':26B 'may':41B 'medium':56B,96C 'misrepresent':65C 'page':5A,24B,92C 'password':8A,20B,32B,67C 'prior':74C 'rate':50B 'remot':79C 'requir':63B 'secur':53B,94C 'sever':54B,95C 'social':45B,59B,82C 'sourc':49B 'spoof':7A,85C 'trick':43B 'ui':64C,86C 'user':40B 'via':88C","nicknames":[],"mitigations":[],"who_affected":"People who use Google Chrome on iOS with the Passwords feature and who open a crafted HTML page, typically after being socially engineered into visiting it. Businesses managing iOS devices should check Chrome versions on managed devices. Devices on Chrome versions at or above 157.0.8103.38 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your iPhone or iPad to version 157.0.8103.38 or later.","pkeys":[],"ptokens":[],"labels":["chrome","ios","medium","other","passwords"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121186","severity":null,"published_at":"2026-11-03T21:17:27+00:00","modified_at":"2026-11-03T21:17:27+00:00","first_seen_at":"2026-11-03T21:19:25+00:00","fetched_at":"2026-11-03T21:19:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}