CVE-2026-121177 in Chrome
Summary
by MITRE • 11/03/2026
UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CVE-2024-6974 represents a user interface deception flaw within the Google Chrome browser for iOS, specifically affecting versions prior to 157.0.8103.38. This issue stems from an improper handling of page information metadata, which allows a remote attacker to manipulate how certain UI elements are rendered or perceived by the end-user. By crafting a malicious HTML page that exploits this misrepresentation, an adversary can create visual discrepancies between what is displayed on the screen and the actual underlying state of the application or webpage. This type of vulnerability falls squarely under the category of User Interface Misinterpretation, commonly referenced in industry standards as CWE-841. The core technical flaw lies in the browser's rendering engine failing to correctly isolate or validate UI components that convey trust indicators, such as address bar contents or security status icons, thereby enabling an attacker to overlay deceptive elements over legitimate interface features.
From a tactical perspective, this vulnerability aligns with several techniques within the MITRE ATT&CK framework for mobile platforms and web applications. It is closely associated with Obfuscated Files or Information (T1027) when used in conjunction with obfuscation scripts, but more directly maps to Impair Defenses (T1562), specifically under the sub-technique of Disable or Modify Tools if it interferes with security warnings, and potentially Social Engineering via Phishing (T1534). The primary operational impact is the facilitation of phishing attacks. An attacker can craft a page that visually mimics a trusted domain or application while actually directing user input to a malicious server. Because Chrome on iOS relies heavily on visual cues for trust assessment, such as the lock icon in the address bar indicating HTTPS connectivity, spoofing these elements undermines the fundamental security model of web browsing. Users may inadvertently enter sensitive credentials, financial information, or personal data into a fraudulent interface that appears legitimate due to the UI misrepresentation.
The severity is classified as Medium by Chromium because while it does not allow for direct code execution or remote access control in itself, it serves as a powerful vector for social engineering attacks which can lead to significant compromise of user accounts and data privacy. The exploitability relies on the victim visiting a specifically crafted URL hosted by an attacker. Once loaded, the malicious HTML leverages CSS positioning, JavaScript DOM manipulation, or other rendering quirks to overlay fake UI elements over genuine ones. For instance, an attacker might display a spoofed address bar showing https://bank.com while the actual page is served from http://evil.com. This discrepancy can confuse users who rely on visual confirmation of security status rather than technical verification through certificate inspection tools.
Mitigation for this vulnerability requires immediate action by end-users to update their Google Chrome application on iOS devices to version 157.0.8103.38 or later, where the rendering logic has been corrected to prevent such UI spoofing. For organizations deploying managed browsers, ensuring that device management policies enforce automatic updates is critical. Additionally, security awareness training should emphasize verifying URL details manually rather than relying solely on visual cues provided by the browser interface. Users are advised to inspect the full domain name in the address bar and verify certificate validity through explicit checks if they encounter any suspicious UI behavior. While no known workarounds exist that do not involve updating the software, maintaining up-to-date client-side security components remains the most effective defense against this class of user interface deception vulnerabilities.