CVE-2026-13837: Chrome CSS UI Spoofing Vulnerability – Patch to v150.0.7871.47

Technical summary

CVE-2026-13837 stems from improper CSS implementation in Chromium that fails to adequately restrict styling of UI-sensitive elements. The vulnerability is classified under CWE-451 (User Interface Rendering of Untrusted Data). An unauthenticated remote attacker can exploit this via a crafted HTML page to achieve visual UI spoofing without requiring any special privilege or interaction beyond the user visiting the page. The Chromium security team assigned this a High severity rating internally, though the CVSS 3.1 score of 4.3 reflects the limited direct impact—the attack requires user interaction and does not directly compromise confidentiality, integrity of system data, or availability.

Business impact

UI spoofing attacks can significantly erode user trust and increase susceptibility to credential theft and social engineering. Organizations whose employees use Chrome may face elevated phishing risk if users cannot reliably distinguish legitimate UI from attacker-controlled content. The impact is primarily reputational and user-safety focused rather than infrastructure-focused, but widespread adoption of Chrome in corporate environments means organizations should monitor and prepare for the update.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all Chrome installations on Windows, macOS, Linux, Android, and iOS running versions earlier than 150.0.7871.47. Chromebooks and Chrome enterprise deployments are also in scope.

Exploitability

Exploitability is moderate. The attack requires no authentication or special privileges and can be delivered over the network via any webpage. However, the user must actively visit a malicious page—there is no drive-by or in-the-wild wormable vector. The attack relies on visual deception rather than memory corruption or code execution, making it practical for targeted phishing but less suitable for mass exploitation. No public exploit code or active exploitation has been reported at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome typically auto-updates, but organizations should verify that updates have deployed across their user base. For enterprise deployments, verify the update via chrome://version/ on managed devices and confirm policy-driven rollout is complete.

Patch guidance

Chrome auto-update is the primary remediation path. End-users should ensure automatic updates are enabled (the default setting). Enterprise administrators using Chrome policies should verify the ChromeVersion policy reports 150.0.7871.47 or higher across their managed fleet. Manual updates are available via Help > About Google Chrome, which will automatically install the latest version and prompt for restart if needed. No workarounds are available; patching is required.

Detection guidance

Monitor Chrome version telemetry to identify systems still running versions prior to 150.0.7871.47. Web filters and email gateways cannot easily detect malicious HTML leveraging this CSS flaw without deep content inspection. User education remains important—train users to verify URLs in the address bar, check certificate indicators, and be skeptical of unexpected login prompts or warnings. Consider endpoint detection and response (EDR) to monitor for suspicious domain visits or phishing infrastructure if available.

Why prioritize this

While the CVSS score is moderate (4.3), this vulnerability should receive prompt attention because it directly enables phishing and social engineering at scale. Chrome's ubiquity in enterprise and consumer environments means rapid patching is critical to prevent user compromise. However, organizations dependent on legacy systems or restricted update schedules should prioritize patching workstations used for email, web browsing, and other high-risk activities. The lack of KEV listing suggests no active ransomware campaigns are currently exploiting it, but the attack is straightforward and does not require sophisticated tooling.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM severity) reflects the attack vector (network), low complexity, no privilege requirement, and user interaction required. Integrity impact is rated as LOW because the attack spoofs the UI but does not corrupt data or execute code. Confidentiality and availability are unaffected. The discrepancy between the internal Chromium High severity rating and the lower CVSS score reflects that Chromium weights user trust and UX security concerns more heavily than the CVSS model does. For security prioritization, consider both the CVSS score and the business context (phishing risk).

Frequently asked questions