CVE-2024-13983: 
Google Chrome vulnerability analysis and mitigation

CVE-2024-13983 is a UI spoofing vulnerability caused by an inappropriate implementation in the Lens feature of Google Chrome on iOS. A remote attacker can exploit this by crafting a malicious QR code to manipulate the browser's user interface, potentially deceiving users. The vulnerability affects Google Chrome versions prior to 136.0.7103.59 on iOS. It was reported by researcher Zeddy from CUHK on 2024-11-19 and patched in the Chrome 136 stable channel release on April 29, 2025. It carries a CVSS v3.1 base score of 6.3 (Medium) and is rated Low severity by the Chromium security team (Chrome Releases, Red Hat CVE).

The root cause is an inappropriate implementation (CWE-601: URL Redirection to Untrusted Site / Open Redirect) within Chrome's Lens feature on iOS, which fails to properly validate or sanitize QR code content before rendering UI elements. An attacker can craft a malicious QR code that, when scanned via Chrome's Lens feature, causes the browser to display spoofed or misleading UI elements to the user. Exploitation requires user interaction — specifically, the victim must scan the attacker-controlled QR code using Chrome on iOS. A proof-of-concept issue is tracked in the Chromium bug tracker (Chromium Issue, Chrome Releases).

Successful exploitation allows a remote attacker to perform UI spoofing within Google Chrome on iOS, potentially misleading users about the content or destination of a QR code scan. This could facilitate social engineering attacks, phishing, or misdirection of user interactions within the browser. The confidentiality, integrity, and availability impacts are each rated Low, and the scope is unchanged, meaning the attack is confined to the Chrome browser context on the affected iOS device (Red Hat CVE).

A proof-of-concept is referenced in the Chromium issue tracker (issue #379818904), but there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.035%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (Chromium Issue, Red Hat CVE).

1. Craft a malicious QR code: Create a QR code containing a specially crafted payload designed to exploit the inappropriate implementation in Chrome's Lens feature on iOS, such as a URL or content string that triggers UI spoofing behavior.
2. Deliver the QR code: Present the malicious QR code to the target via a website, email, printed material, or any medium where the victim is likely to scan it using Chrome on iOS.
3. Victim scans the QR code: The target uses Chrome's Lens feature on their iOS device to scan the QR code, triggering the vulnerable code path.
4. UI spoofing occurs: The browser renders misleading or attacker-controlled UI elements, potentially tricking the user into believing they are interacting with a legitimate site or interface, enabling further social engineering or phishing (Chromium Issue, Chrome Releases).

Google has addressed this vulnerability in Chrome 136.0.7103.59 (Linux) and 136.0.7103.48/49 (Windows and Mac), released on April 29, 2025. Users on iOS should update Chrome to version 136.0.7103.59 or later immediately. As a behavioral workaround, users should avoid scanning QR codes from untrusted or unknown sources using Chrome's Lens feature, and verify QR code destinations before scanning (Chrome Releases).