CVE-2026-13867: Chrome UI Spoofing Vulnerability in Geolocation Feature

Technical summary

CVE-2026-13867 stems from an inappropriate implementation of the Geolocation API in Chromium's code base (CWE-451: User Interface (UI) Misrepresentation of Critical Information). The vulnerability allows an unauthenticated remote attacker to construct a specially crafted HTML page that manipulates the browser's UI presentation layer. When a user visits the page, the attacker can spoof interface elements, potentially tricking users into granting permissions or performing actions they believe are legitimate. The vulnerability has a CVSS 3.1 score of 4.3 (Medium severity) with a network attack vector, low complexity, and a requirement for user interaction.

Business impact

This vulnerability primarily creates a social engineering vector rather than a direct data exfiltration risk. An attacker could use UI spoofing to impersonate Chrome's permission dialogs or warnings, potentially tricking users into granting location access or other sensitive permissions. For organizations with bring-your-own-device (BYOD) policies or remote workforces relying on Chrome, this could lead to unauthorized location data leakage or user deception. The impact is limited by the fact that data confidentiality and system availability are not compromised, but integrity of the user experience is affected.

Affected systems

Google Chrome versions before 150.0.7871.47 are affected. This includes all releases of Chrome prior to the patched version across Windows, macOS, Linux, and Android platforms. Organizations should verify their deployed Chrome versions, including those managed through enterprise policies and auto-update mechanisms. Users on older Chrome release channels or with updates deferred may face extended exposure.

Exploitability

Exploitation requires a remote attacker to host or inject a crafted HTML page and trick a user into visiting it. While the attack vector is network-based and requires no special privileges, it mandates user interaction—clicking a link or navigating to the malicious page. This moderately lowers the practical exploitability compared to issues requiring no user action, but the bar remains low given how easily malicious links can be distributed via email, social media, or compromised advertising. No known public exploit code or active attacks are referenced in the vulnerability record, and the issue has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Google typically delivers security updates automatically on Windows, macOS, and Linux, but organizations should verify updates have been applied and, where necessary, enforce updates through enterprise policy. Chrome on Android should similarly be updated via the Play Store. Organizations using managed Chrome deployments should use enterprise policy configuration tools to ensure timely patching across endpoints.

Patch guidance

Verify and deploy Google Chrome version 150.0.7871.47 or later across all managed endpoints. For enterprise customers, use the Chrome Enterprise policy settings (chrome://policy) to monitor and enforce minimum version requirements. Check the Google Chrome release notes at https://chromereleases.googleblog.com/ to confirm the patch version and any related updates. Organizations should test the update in a limited environment before broader rollout to ensure compatibility with internal web applications and extensions.

Detection guidance

Verify Chrome version through chrome://version/ on user machines or through enterprise management tools. Monitor for the presence of Chrome versions below 150.0.7871.47 in inventory systems. Detection of exploitation post-compromise is difficult, as UI spoofing attacks leave minimal forensic artifacts beyond browser history logs showing visits to malicious sites. Monitor for suspicious permission grants in Chrome's site settings or unexpected location access claims, particularly if concentrated around credential entry pages or sensitive web portals.

Why prioritize this

While this vulnerability scores as Medium severity and does not appear in active exploitation campaigns, it should be prioritized for patching due to its ease of exploitation, low user technical barrier, and applicability to Chrome's ubiquitous presence in enterprise and consumer environments. The social engineering angle makes it attractive for targeted phishing campaigns. Organizations should treat this as part of regular Chrome maintenance cycles rather than an emergency, but should not defer patching beyond normal update windows.

Risk score, explained

CVSS 3.1 score of 4.3 reflects the low attack complexity and network accessibility (high exploitability) balanced against the requirement for user interaction and limited impact (no confidentiality or availability breach, only integrity of UI presentation). The score is not elevated to High severity because the vulnerability does not enable direct unauthorized access to sensitive data or system functions; instead, it enables deception of the end user. Organizations with high-security postures may wish to apply additional weight to the social engineering risk factor.

Frequently asked questions