CVE-2026-13973: Chrome UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-13973 is a UI spoofing vulnerability arising from inappropriate implementation in Chrome's user interface layer (CWE-451: User Interface (UI) Misrepresentation of Critical Information). The vulnerability requires user interaction—specifically, directed UI gestures—to trigger the spoofing condition. An attacker crafts an HTML page that exploits the flaw to overlay or mimic legitimate browser UI elements. The attack surface is network-based, and while browser sandbox protections limit impact, the integrity of the user's visual trust model is compromised. CVSS v3.1 score of 4.2 (Medium) reflects the requirement for user manipulation, absence of confidentiality impact, and limited integrity and availability degradation.

Business impact

This vulnerability primarily enables social engineering at scale. Users may be deceived into entering credentials, approving permissions, or revealing sensitive information when presented with spoofed UI elements that appear legitimate. For enterprises, the risk manifests as increased phishing susceptibility—attackers can host malicious pages and conduct credential harvesting campaigns with higher success rates. While the direct technical impact is limited (no data exfiltration, no code execution), the downstream consequences of credential compromise can be severe, potentially leading to account takeovers, lateral movement, and data breaches.

Affected systems

The vulnerability affects Google Chrome on multiple operating systems: macOS, Linux, and Windows. Users running Chrome versions prior to 150.0.7871.47 are at risk. The advisory does not indicate version-specific constraints on other platforms; assume all supported OS versions of Chrome below 150.0.7871.47 are vulnerable.

Exploitability

Exploitability is moderate but practical. An attacker must convince a user to visit a crafted page and then perform specific UI gestures (mouse clicks, keyboard input, or focus actions) to trigger the spoofing. This is not an automatic exploit; it requires social engineering or lures that increase user engagement. The barrier to exploitation is relatively low for a well-motivated threat actor conducting targeted phishing, but mass exploitation would face adoption challenges due to the user interaction requirement.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Users should enable automatic updates to ensure timely patching. Organizations should enforce Chrome version policies via group policy (Windows) or Mobile Device Management (MDM) solutions to prevent use of vulnerable versions.

Patch guidance

Chrome typically rolls out patches automatically, but users can manually verify the installed version by navigating to chrome://settings/help. The page displays the current version and automatically checks for updates. Organizations deploying Chrome via managed environments should configure update policies to enforce version 150.0.7871.47 as the minimum acceptable version. Test patching in a controlled environment first if Chrome is mission-critical to your workflows; no backward compatibility issues are expected from this release.

Detection guidance

Monitor for Chrome version compliance in your environment using endpoint detection and response (EDR) tools or mobile device management solutions that report software inventory. Web traffic inspection tools may not directly detect exploitation attempts, as the attack relies on legitimate HTML/JavaScript rendering. However, security awareness training should emphasize recognition of suspicious UI elements, unexpected permission prompts, and login screens that appear outside the browser's normal context. Consider deploying browser security extensions that provide additional UI spoofing protections, such as visual indicators for phishing or fake certificate warnings.

Why prioritize this

Although the CVSS score is Medium (4.2), this vulnerability warrants expedited patching because UI spoofing is a well-established attack vector with proven effectiveness in social engineering campaigns. The low friction of exploitation—requiring only user interaction with a webpage—means broad exposure. Prioritize patching in roles with elevated access (finance, HR, IT administrators) who are high-value targets for credential harvesting. Organizations in regulated industries should patch within 30 days to meet compliance expectations for timely remediation of known vulnerabilities.

Risk score, explained

The CVSS v3.1 score of 4.2 (Medium) reflects: Network attack vector (AV:N) with high attack complexity (AC:H) due to the requirement for specific user gestures; no privileges required (PR:N) but user interaction is mandatory (UI:R); unchanged scope (S:U); no confidentiality impact (C:N); limited integrity impact (I:L) from UI misrepresentation; and low availability impact (A:L). This score appropriately captures the technical difficulty of exploitation and contained direct impact, but does not fully quantify downstream risks from successful credential harvesting, which may justify higher organizational prioritization.

Frequently asked questions