CVE-2026-13955: Chrome Android UI Spoofing Vulnerability—CVSS 3.3 Low

Technical summary

CVE-2026-13955 is a CWE-20 (Improper Input Validation) flaw in Chrome's CustomTabs component on Android versions before 150.0.7871.47. The vulnerability allows insufficient validation of untrusted input, enabling a local attacker to perform UI spoofing attacks through a specially crafted malicious file. The Chromium security team classified this as Medium severity. The attack vector is local, requires no privileges, and depends on user interaction. The integrity impact is limited (the attacker can manipulate UI elements but cannot leak confidential data or cause availability issues). The CVSS 3.1 score of 3.3 reflects the low overall risk due to the local attack vector and UI-only impact.

Business impact

This vulnerability poses a containment risk in environments where users may be socially engineered via manipulated Chrome UI elements. An attacker could spoof trust indicators, fake security warnings, or disguise phishing prompts as legitimate Chrome dialogs, potentially increasing successful credential harvesting or malware distribution campaigns targeting Android users. For most organizations, the business risk is low because exploitation requires device access and user interaction, and the impact is limited to deception rather than direct data exfiltration or system takeover. However, organizations with high-risk mobile user bases or stringent UI integrity requirements should prioritize patching to eliminate social engineering vectors.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. CustomTabs, a Chrome feature that allows apps to open web content within an app's context, is the specific component vulnerable. Any Android device running an affected Chrome version is potentially vulnerable if a user interacts with a malicious file that triggers the vulnerability. Desktop and iOS versions of Chrome are not affected by this specific flaw.

Exploitability

Exploitability is limited by multiple factors: (1) the attack requires local access to the device, (2) the attacker must convince a user to interact with a malicious file, and (3) the impact is confined to UI manipulation rather than code execution or data access. Real-world exploitation would likely target users already at physical or logical proximity, making mass exploitation infeasible. The vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) list, indicating no evidence of active exploitation in the wild at this time. The combination of local-only attack vector and user interaction requirement substantially reduces practical risk.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. For enterprise environments managing Android devices, deploy Chrome updates through mobile device management (MDM) solutions to ensure consistent patching. Users should enable automatic Chrome updates in the Google Play Store settings to receive patches promptly. No workarounds or mitigations short of patching are effective; the vulnerability can only be resolved by updating the affected component.

Patch guidance

Google has released Chrome version 150.0.7871.47 or later containing the fix. Patch deployment priority should be moderate for general user populations but elevated for organizations where Chrome CustomTabs are used in security-sensitive workflows. On Android, patches are typically delivered through the Google Play Store; enable automatic updates or manually check Settings > Apps > Chrome > Update to ensure you are running the latest version. Organizations using managed Android deployments should verify that their MDM solution has pushed the patched version to all affected devices. No interim patches or beta releases are needed; the stable release addresses the vulnerability.

Detection guidance

Monitor for user reports of unusual or unexpected Chrome UI behavior, especially anomalous trust indicators or unexpected security prompts. On a technical level, detection is challenging because the vulnerability manifests as benign-looking UI rendering; endpoint detection and response (EDR) tools may flag suspicious file interactions if the malicious file is known to security vendors. Organizations should focus on user awareness training to help staff recognize spoofed Chrome dialogs. Network monitoring cannot easily detect this vulnerability's exploitation because the attack is entirely local to the device.

Why prioritize this

Despite low CVSS (3.3) and no KEV listing, this vulnerability warrants priority in routine patching cycles because: (1) it affects a ubiquitous application (Chrome) on a widespread platform (Android), (2) UI spoofing can amplify social engineering effectiveness, and (3) the fix is straightforward and carries minimal deployment risk. However, this is not a critical emergency requiring out-of-cycle patching. Organizations should include it in their next planned Chrome update cycle, treating it with the same urgency as other low-severity browser patches. High-risk user populations (executives, customer-facing roles) may benefit from priority patching to reduce targeted social engineering risk.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW severity) reflects: (1) Local attack vector—reduces risk by excluding remote exploitation, (2) No privilege requirement—increases risk slightly, (3) User interaction required—further reduces risk, (4) Limited integrity impact—the attacker can only manipulate UI, not access data or crash the system, and (5) No confidentiality or availability impact. The score appropriately downweights the threat because exploitation requires physical or logical proximity and deliberate user action, and the impact cannot cascade to other systems or leak sensitive information. Chromium's Medium severity designation aligns with the CVSS Low rating and reflects the Android ecosystem's focus on local-attack-vector risks.

Frequently asked questions