CVE-2026-13960: Chrome Password UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-13960 stems from an inappropriate implementation in Chrome's password handling functionality, classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information). The vulnerability allows network-based attackers to craft HTML pages that spoof or misrepresent the browser's UI elements related to passwords. Since the attack requires user interaction (clicking, typing, or otherwise engaging with the spoofed UI), it cannot be exploited silently. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for user interaction, absence of authentication bypass, and limited scope—integrity can be compromised through credential theft or social engineering, but confidentiality and availability are not directly affected.

Business impact

This vulnerability primarily threatens user credential security and organizational data access control. Employees using affected Chrome versions may be tricked into entering passwords into fake dialogs, potentially giving attackers access to corporate accounts, email, cloud services, or internal systems. For organizations with bring-your-own-device (BYOD) policies or where Chrome is the standard browser, the risk extends across a wide user base. The impact is heightened in industries handling sensitive data (financial services, healthcare, legal) where credential compromise directly enables data theft or fraud. Financial damage stems from potential account takeovers, unauthorized access to proprietary information, and incident response costs.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all Chrome installations on Windows, macOS, Linux, Android, and iOS running version 150.0.7871.46 or earlier. The vulnerability affects both standard Chrome and Chrome-based browsers that inherit this code. Organizations should inventory Chrome deployments across all platforms—including mobile devices and managed enterprise instances—to determine exposure. Users running older versions, particularly those with automatic updates disabled or delayed, face the highest risk.

Exploitability

Exploitability is moderate. The attack requires crafting a convincing HTML page and social engineering the user into visiting it—defenders have the advantage of user awareness as a protective layer. Attackers cannot exploit this remotely without user interaction; clicking a link or visiting a malicious site is necessary. However, phishing emails, compromised ad networks, or watering hole attacks make distribution feasible. The UI spoofing capability is likely to be discovered and exploited once patch information circulates, making disclosure of the vulnerability a turning point in risk elevation. No known public exploits or KEV listing currently exist, but the attack surface is large given Chrome's market share.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will typically deploy the patch within days of release, but verify that updates are enabled in your environment. Users should manually check Settings > About Chrome to force an update check if auto-update is slow. For enterprise deployments, test the patched version in a staging environment, then push via Group Policy (Windows), configuration profiles (macOS/iOS), or MDM solutions (Android) to ensure controlled rollout.

Patch guidance

Verify the Chrome version on affected systems (Chrome menu > Settings > About Chrome displays the current version). Version 150.0.7871.47 and all later versions in the 150.x.x.x series and subsequent major versions contain the fix. Organizations using Chrome policies should confirm auto-update policies are active (chrome://policy/ on Windows/Linux or System Preferences > Profiles on macOS). For air-gapped or restricted environments, download the installer from Google's official distribution channels and test in a sandbox before deployment. No configuration workarounds exist; patching is the only mitigation.

Detection guidance

Detection of exploitation is challenging because the attack manifests as user behavior (credential entry into a spoofed dialog) rather than network anomalies. Focus on behavioral indicators: monitor for unusual login patterns (logins from unexpected geographic locations, devices, or times), spike in failed authentication attempts from specific users, or access to sensitive systems shortly after a user visited a phishing link. Deploy user awareness training to report seeing suspicious password prompts. Endpoint detection and response (EDR) tools should flag Chrome process spawning suspicious child processes or network connections immediately after password prompts appear. Web proxy logs may reveal visits to known phishing domains; correlate these with subsequent authentication anomalies.

Why prioritize this

Prioritize patching this vulnerability for high-value targets: users with administrative privileges, finance/HR staff with access to payroll and banking systems, and employees handling confidential customer or intellectual property data. BYOD and remote workers present higher risk because their Chrome instances may not receive patches promptly. While the CVSS score is MEDIUM (4.3), the real-world impact—credential compromise—makes it functionally higher-priority than the score suggests. Organizations with strong phishing defenses and user training can deprioritize slightly, but the vulnerability should not be deferred more than 2–3 weeks.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: AV:N (network-based attack), AC:L (low attack complexity, only requiring HTML crafting), PR:N (no privileges required), UI:R (user interaction mandatory—a limiting factor), S:U (no scope escalation), C:N (confidentiality not compromised), I:L (integrity slightly compromised through credential theft), A:N (availability unaffected). The score appropriately caps at MEDIUM because the attack requires social engineering and user action. However, in practice, successful exploitation leads to credential compromise—a critical business outcome—so practitioners should weight this above the numerical score in risk decisions.

Frequently asked questions