CVE-2026-13865: Chrome UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

The vulnerability stems from insufficient validation of untrusted input in Chrome's Enterprise build prior to version 150.0.7871.47. The flaw enables UI spoofing attacks through carefully constructed HTML pages. The attack vector is network-based with low attack complexity, requires no special privileges, but does require user interaction to visit a malicious page. The integrity impact is limited (CWE-20: Improper Input Validation), with no confidentiality or availability consequences. Chromium's security team assigned a Medium severity rating.

Business impact

UI spoofing attacks can undermine user trust and lead to credential theft, social engineering, or fraudulent transactions if attackers overlay fake interface elements on legitimate-looking pages. For organizations relying on Chrome, especially in customer-facing or security-sensitive contexts, this could enable phishing attacks that bypass users' visual cues. The requirement for user interaction means impact depends on user behavior; however, the low attack complexity makes exploitation straightforward once a user lands on a malicious site.

Affected systems

Google Chrome Enterprise versions prior to 150.0.7871.47 are affected. Standard Chrome installations at or before version 150.0.7871.46 should be considered vulnerable. Users on earlier release channels or extended support versions should verify their specific build number against the vendor advisory to confirm exposure.

Exploitability

This vulnerability has a CVSS 3.1 score of 4.3 (Medium), reflecting moderate but not critical risk. Exploitation requires network access and user interaction (clicking through to a crafted page) but no special privileges or pre-existing access. The low attack complexity means an attacker can reliably craft a working exploit; however, success still depends on user engagement. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been publicly documented as of the last update.

Remediation

Organizations should upgrade Chrome to version 150.0.7871.47 or later. Google's automatic update mechanism should deploy the patch; however, administrators should verify completion across their user base, particularly for managed enterprise deployments. No workarounds are documented; patching is the primary remediation path.

Patch guidance

Verify that Chrome has updated to version 150.0.7871.47 or a later release. For enterprise-managed deployments, confirm the patch deployment policy and monitor rollout completion. Check Chrome's About page (chrome://about) to see the current version; the browser will indicate if an update is pending. No interim patches or partial updates are required; the standard update channel will deliver the fix.

Detection guidance

Monitor user browsing activity for visits to newly registered or suspicious domains that serve crafted HTML content. Network detection is challenging without direct visibility into page content; however, endpoint security tools can flag suspicious page rendering behavior or alert on known malicious domains. User reports of unusual browser interface behavior warrant investigation. In enterprise environments, consider restricting access to untrusted external sites where feasible.

Why prioritize this

While the CVSS score is Medium (4.3) and there is no current KEV listing, this vulnerability merits prompt patching due to low attack complexity and the potential for targeted phishing campaigns. Organizations with high-risk user populations (executives, finance teams, customer-facing roles) should prioritize rollout. However, this is not a critical zero-day requiring emergency response; standard patch management timelines (weeks rather than days) are appropriate.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the attack vector (network, any unauthenticated user), low complexity to craft an exploit, requirement for user interaction, and limited scope to integrity (spoofed UI elements do not directly compromise confidentiality or system availability). The rating appropriately reflects a real but contained risk that depends on user behavior. Organizational risk may vary: users in security-sensitive roles or handling sensitive transactions face higher contextual risk.

Frequently asked questions