CVE-2026-13941: Chrome Android UI Spoofing Vulnerability – Patch Guidance

Technical summary

CVE-2026-13941 stems from an inappropriate implementation in Chrome's SiteSettings mechanism on Android. The vulnerability allows UI spoofing—a technique where an attacker manipulates the visual presentation of the browser's permission and settings interface to misrepresent the actual state of user permissions or security controls. The flaw is triggered when a user visits a malicious HTML page; no additional action or elevated privileges are required. The attack surface is network-accessible and the barrier to entry is low, as crafting a deceptive HTML page is straightforward. The underlying weakness is classified as CWE-451 (User Interface (UI) Misrepresentation of Critical Information), which encompasses situations where critical security information is presented in a way that can be manipulated or obscured.

Business impact

UI spoofing vulnerabilities directly undermine user trust in browser security indicators. If users cannot reliably see whether a site has been granted microphone, camera, or location permissions, they may unknowingly expose sensitive data or grant unintended access to device capabilities. For organizations, this increases support burden—users may report unexpected permission behavior—and raises the risk of phishing or social engineering campaigns that leverage fake permission dialogs to harvest credentials or enable surveillance. The impact is primarily integrity-based (information misrepresentation) rather than direct data theft or system compromise.

Affected systems

This vulnerability affects Google Chrome on Android versions prior to 150.0.7871.47. The issue is specific to Android because the vulnerability lies in how Chrome's SiteSettings UI is rendered on that platform. Desktop versions of Chrome are not affected by this particular flaw. Any organization or user running Chrome on Android below the patched version should be considered at risk, particularly those handling sensitive communications or accessing high-value resources via mobile browsers.

Exploitability

Exploitability is moderate. The attack requires user interaction—a victim must visit a malicious HTML page—but no special techniques, authentication, or system compromise are needed. An attacker could distribute the malicious page via email, social media, or a compromised website. The CVSS score of 4.3 (Medium severity) reflects this: network-accessible, low complexity, requires user interaction, and results in a limited integrity impact (UI deception rather than code execution or data exfiltration). This is not a high-priority remote code execution vulnerability, but it is a credible social engineering enabler.

Remediation

Update Chrome on Android to version 150.0.7871.47 or later. Google's automatic update mechanism should deliver this patch to most users; however, organizations managing Android devices should verify rollout and consider using mobile device management (MDM) policies to enforce the minimum version. No workarounds are available for this vulnerability—patching is the only mitigation.

Patch guidance

Verify that Chrome on Android is updated to version 150.0.7871.47 or newer. Users can check their version in Chrome settings (Menu > About Chrome > Check for updates). Organizations using Google Workspace or managing corporate Android devices should confirm that the patch is deployed enterprise-wide. If you manage an Android fleet, use your MDM solution to report on Chrome version compliance and enforce automatic updates. The patch was released in response to the vulnerability disclosure and should be prioritized as part of regular mobile security updates.

Detection guidance

Detection of successful exploitation is challenging because UI spoofing leaves limited forensic evidence on the device itself. Monitor for user reports of unexpected permission prompts or inconsistent permission behavior in Chrome. On the network side, look for patterns of users visiting known malicious URLs or domains that host UI spoofing HTML payloads. Security teams should educate users to scrutinize permission dialogs—legitimate Chrome permission prompts have specific visual characteristics and come from Chrome itself, not from web pages. Consider conducting phishing simulations that include fake permission dialogs to measure user awareness.

Why prioritize this

While the CVSS score is moderate (4.3), this vulnerability should be patched promptly because UI spoofing is a well-established social engineering vector. Although the vulnerability does not enable remote code execution, it can be leveraged to trick users into granting microphone or camera access for surveillance, or to harvest credentials through fake login dialogs. The reliance on user interaction and the limited direct technical impact mean this is not a critical vulnerability, but it warrants priority within your mobile security update cycle. Organizations handling sensitive mobile communications or managing BYOD environments should treat this as a near-term patch requirement.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) accurately reflects the vulnerability's characteristics: AV:N (network-accessible attack vector), AC:L (low complexity), PR:N (no privileges required), UI:R (user interaction required), and I:L (low integrity impact). The lack of confidentiality or availability impact—the attacker cannot read data or crash the browser, only misrepresent UI—keeps the score in the Medium range rather than High. The user interaction requirement is the primary factor preventing a higher score. However, real-world risk depends on context: a user who frequently grants permissions without scrutiny faces higher practical risk from this flaw than one who carefully reviews each permission prompt.

Frequently asked questions