CVE-2026-13895: Google Chrome Autofill UI Spoofing Vulnerability (CVSS 4.2)

Technical summary

CVE-2026-13895 stems from an inappropriate implementation in Chrome's autofill mechanism that enables UI spoofing attacks. An attacker could craft HTML pages that, when combined with specific user gestures, deceive users into believing they are interacting with authentic browser UI elements or website content. The vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), reflecting the core issue of UI deception rather than direct data theft or system compromise. The CVSS 3.1 score of 4.2 (Medium) reflects the requirement for user interaction, network connectivity, and the limited integrity and availability impact.

Business impact

This vulnerability presents a phishing and social engineering risk rather than a direct system compromise vector. Attackers could use spoofed UI elements to capture credentials, trick users into authorizing unwanted actions, or deceive them into downloading malware. While not a system-level threat, the reputational risk and user trust implications warrant timely patching, particularly for organizations with high-risk user populations or those targeted by sophisticated phishing campaigns.

Affected systems

Google Chrome browser versions prior to 150.0.7871.47 are vulnerable. All platforms running affected versions are in scope—Windows, macOS, and Linux deployments. The vulnerability does not affect other Chromium-based browsers unless they incorporate the same flawed autofill implementation, though vendors should verify their own release notes.

Exploitability

Exploitation requires a remote attacker to convince a user to visit a crafted webpage and perform specific UI gestures (such as clicking or interacting with form elements). The attack is not wormable, does not require elevated privileges, and does not execute arbitrary code. The necessity for user interaction and specific gesture sequences moderates the practical exploitation rate in the wild, though targeted campaigns against specific users or organizations remain plausible. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.

Remediation

Users and administrators should update Google Chrome to version 150.0.7871.47 or later. Automatic updates are the default behavior in Chrome, but manual verification is recommended in enterprise environments. No workarounds exist; patching is the only mitigation. Organizations should communicate the importance of keeping Chrome current to end users, particularly those in roles targeted by phishing attacks.

Patch guidance

Deploy Google Chrome 150.0.7871.47 or later across all endpoints. In managed environments, use Chrome Enterprise policies to enforce automatic updates or schedule updates during maintenance windows. Verify patch deployment by checking the browser version in Chrome settings (chrome://settings/help). Test autofill functionality after patching to confirm no regression in legitimate use cases. For organizations with centralized Chrome deployments, consult Google's official Chrome Enterprise and Education release notes to confirm version availability and any associated blocklist or policy changes.

Detection guidance

Monitor for users reporting unexpected or suspicious autofill behavior, including forms that appear to belong to legitimate sites but redirect or capture credentials unexpectedly. Network-based detection is limited due to the client-side nature of the vulnerability; focus on endpoint telemetry showing user interaction with suspicious HTML pages or unusual autofill patterns. Behavioral analytics can flag users who interact with phishing pages, particularly if combined with failed login attempts or credential submissions to unexpected domains. No specific log signatures are known at this time; detection is best achieved through user education and phishing email filtering.

Why prioritize this

While the CVSS score is moderate (4.2), the reliance on user interaction and the lack of active exploitation in the wild reduce immediate urgency. However, organizations with security-aware users or those heavily targeted by phishing should prioritize patching to reduce social engineering risk. The fix is low-risk (UI behavior improvements) and deployment is straightforward due to Chrome's auto-update mechanism, making this a good candidate for routine patch cycles rather than emergency response.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects the Medium severity rating. The score is driven by: Network-accessible attack vector (AV:N), high attack complexity due to required user gestures (AC:H), no privilege requirement (PR:N), and user interaction necessity (UI:R). Scope is unchanged (S:U), and the impact is limited to integrity and availability (I:L, A:L) with no confidentiality loss (C:N). The lack of CEP or widespread exploitation prevents this from reaching High or Critical status.

Frequently asked questions