CVE-2026-13978: Chrome UI Spoofing Vulnerability in PageInfo – Patch to 150.0.7871.47

Technical summary

The vulnerability stems from insufficient policy enforcement in Chrome's PageInfo subsystem, a UI component responsible for displaying domain information, certificate details, and permission controls. The flaw allows a remote attacker to inject or overlay content that mimics Chrome's native security dialogs and information panels. By crafting a specially designed HTML page, an attacker can create a UI spoofing scenario where user-facing elements appear to originate from the browser rather than the webpage. The attack vector is network-based with low attack complexity, requires no privileges, but does depend on user interaction (clicking, accepting, or otherwise engaging with the spoofed UI). No confidentiality impact occurs; the integrity impact is limited to UI deception rather than data compromise. The CWE-451 classification (User Interface (UI) Misrepresentation of Critical Information) confirms that the core issue is misleading presentation of information rather than a data access or code execution flaw.

Business impact

This vulnerability poses a reputational and trust risk rather than a direct data breach threat. Organizations whose users rely on Chrome may see users socially engineered through fake permission prompts, fake security warnings, or fake login dialogs embedded in web pages. Financial services, email providers, and any organization with sensitive web applications should be aware that users could be tricked into revealing credentials or granting access that they believe they are denying. The limited scope (UI only, no data access) means damage is contained to user confusion and potential credential compromise at the application level, not system-wide data exfiltration. The attack's effectiveness depends on attacker skill in mimicking Chrome's UI design and user awareness.

Affected systems

The vulnerability affects Google Chrome installations prior to version 150.0.7871.47. All users on affected versions are potentially vulnerable if they encounter a malicious website. Chrome's widespread use in enterprises, government, and consumer settings means the population at risk is large, though actual exploitation requires the user to visit a crafted page and interact with the spoofed UI. Chromium-based browsers that derive from the affected Chrome codebase may also be affected depending on their version and whether they include the vulnerable PageInfo code; verify against individual vendor advisories for Chromium derivatives (Edge, Brave, Opera, etc.).

Exploitability

Exploitability is moderate. The attack requires network access and low attack complexity, making it easy for an attacker to host a malicious page. However, successful exploitation depends on user interaction—the victim must click on or otherwise engage with the spoofed UI element. No authentication, elevated privileges, or client-side vulnerabilities are needed. The attacker must invest effort in crafting a convincing UI replica to increase the likelihood of success. Once a user is fooled, the attacker gains no direct system access but can harvest credentials or manipulate user trust. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no widespread active exploitation has been confirmed at the time of publication.

Remediation

Users should update Google Chrome to version 150.0.7871.47 or later as soon as possible. Chrome auto-updates by default on most systems, but users can manually check for updates via Settings > About Google Chrome. Organizations should verify that auto-update policies are enabled and that no legacy or offline-managed Chrome deployments are blocking the patch. For Chromium-based browsers, check the respective vendor's security advisory to confirm patch availability and version numbers. No workaround exists other than avoiding untrusted websites, though this is impractical as a long-term solution and does not address users who may be socially engineered into visiting malicious pages via email or other vectors.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will deploy the patch automatically on restart; users can accelerate this by closing and reopening Chrome. Enterprise administrators managing Chrome through group policy or MDM should verify that their update policies do not delay patch deployment. For offline or air-gapped environments, download the latest Chrome installer from Google's official download page and deploy through your standard patch management process. Verify the update by checking Settings > About Google Chrome, which should display version 150.0.7871.47 or higher. For any Chromium-based derivatives in your environment, consult the vendor's security advisory to confirm patch version numbers, as they may differ from Google's versioning scheme.

Detection guidance

Detection of active exploitation is challenging without telemetry integration. Monitor for user reports of suspicious Chrome dialogs or permission prompts that appear unusual. Network-based detection can monitor for traffic to known malicious domains hosting exploit pages, though this requires threat intelligence feeds. Endpoint logging of browser behavior (such as unauthorized UI rendering or abnormal page interactions) would require browser extensions or advanced EDR tools. The best preventive measure is to ensure Chrome is kept up-to-date across all devices. If you suspect a user has been socially engineered via this vulnerability, monitor the associated account for unauthorized access, credential reuse, or lateral movement.

Why prioritize this

This vulnerability should be prioritized as medium urgency rather than critical due to several factors: the CVSS score is 4.3 (medium), no data confidentiality is at risk, the attack requires user interaction, and no known active exploitation has been confirmed. However, UI spoofing attacks are effective in practice and can lead to credential theft, making this more dangerous in practice than the CVSS score alone suggests. Prioritize based on your user base size and exposure to social engineering: organizations with high-risk users (finance, executives, remote workers) should patch faster. The ease of patching (auto-update) justifies moving this ahead of more complex vulnerabilities with lower user impact.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity profile: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), but user interaction necessary (UI:R). Scope is unchanged (S:U), there is integrity impact from UI deception (I:L), but no confidentiality or availability impact (C:N, A:N). The score appropriately captures that the vulnerability is not a remote code execution or data breach vector but a deception attack. In practice, the real-world risk depends on your users' susceptibility to social engineering—a technical user base may be at lower risk than one with limited security awareness. Organizations relying on Chrome in sensitive workflows (finance, healthcare) should treat this as higher than the base score suggests.

Frequently asked questions