CVE-2026-13956: Google Chrome PageInfo UI Spoofing Vulnerability

Technical summary

CVE-2026-13956 is a UI spoofing vulnerability in Chrome's PageInfo component stemming from improper validation of the security interface presentation layer (CWE-451: User Interface (UI) Misrepresentation of Critical Information). The vulnerability resides in how PageInfo renders security warnings and certificate information. By controlling the HTML content delivered to the browser and timing user gestures appropriately, an attacker can cause the PageInfo UI to display false or misleading security information—such as forged certificate details or trust indicators. The CVSS 3.1 score of 4.2 (Medium) reflects that network-based delivery is possible, but successful exploitation requires high interaction complexity and deliberate user action. The attack surface is limited to UI manipulation; cryptographic security and data confidentiality are not compromised.

Business impact

This vulnerability primarily poses a risk to users who may be socially engineered into trusting a malicious site that appears to have legitimate security credentials. Organizations should be concerned if their employees regularly handle sensitive authentication workflows or make trust decisions based on browser security indicators. The impact manifests as reputational damage rather than data breach—users may be tricked into entering credentials on fake login pages that appear to be validated by the browser's security UI. Security teams should educate users about verifying URL addresses directly and not relying solely on PageInfo indicators, especially when handling financial or administrative tasks.

Affected systems

Google Chrome browser versions before 150.0.7871.47 are affected. This includes all platforms where Chrome runs (Windows, macOS, Linux, Android, iOS). Users on older stable release channels, extended stable channels, or who have disabled auto-updates are most at risk. Chromium-based browsers that incorporate unpatched code from the affected Chrome versions may also be vulnerable; verify with your browser vendor.

Exploitability

Exploitation requires a remote attacker to host a crafted HTML page and convince a user to visit it while performing specific UI interactions (such as clicking on security indicators or navigating through PageInfo dialogs). This is a social engineering attack rather than a passive network compromise. The attacker cannot trigger exploitation through malicious network packets alone or by compromising a user's system remotely. The requirement for user awareness and deliberate gesture-based interaction significantly limits real-world attack frequency, though targeted phishing campaigns could amplify risk.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will typically deploy patches within days of release for most users. Organizations managing Chrome via centralized deployment should verify patch deployment status through their management console. No workarounds beyond updating are recommended; disabling PageInfo is not practical and would remove legitimate security information display.

Patch guidance

1. For individual users: Chrome will auto-update. Verify you are on version 150.0.7871.47 or later by navigating to Chrome menu > About Google Chrome; the browser will check for updates and install if available. 2. For enterprise environments: Deploy version 150.0.7871.47 through your organization's Chrome deployment mechanism (Google Admin Console, Intune, MDM, or equivalent). Prioritize updates for machines where employees handle authentication, payments, or administrative tasks. 3. For Chromium-based browsers: Check vendor advisories for patched versions. Verify against official vendor release notes; do not assume Chromium patch releases apply directly to derivative browsers.

Detection guidance

Monitor for user reports of unusual PageInfo behavior, such as unexpected certificate warnings or trust indicators appearing/disappearing during normal browsing. Security awareness logs and help desk tickets mentioning 'browser security warnings not working as expected' may indicate exploitation attempts. From a technical perspective, detect crafted HTML being served alongside page load events that trigger PageInfo display; however, such detection is difficult without proxy-level inspection. Endpoint detection should focus on identifying phishing campaigns that explicitly reference misleading security UI to increase user trust.

Why prioritize this

Although CVE-2026-13956 has a CVSS score of 4.2 (Medium) and is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, it warrants prioritized patching for security-conscious organizations because: (1) it exploits user trust in browser security indicators, a critical social engineering vector; (2) it affects all Chrome users regardless of operating system; (3) patch deployment is straightforward and low-risk; and (4) the attack surface—phishing and credential harvesting—aligns with common attack patterns. Prioritize deployment in environments where users handle sensitive authentication workflows.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects: Attack Vector Network (AV:N) because the attacker must deliver content over the network; Attack Complexity High (AC:H) because the attacker must coordinate UI gestures with crafted content; Privileges Required None (PR:N); User Interaction Required (UI:R); Scope Unchanged (S:U); Confidentiality Impact None (C:N) because data is not exfiltrated; Integrity Impact Low (I:L) because the displayed information is compromised but not the underlying system; and Availability Impact Low (A:L) for the UI component. The low confidentiality impact and requirement for active user cooperation limit the score despite network accessibility.

Frequently asked questions