CVE-2026-13979: Chrome UI Spoofing Vulnerability (150.0.7871.47)

Technical summary

CVE-2026-13979 stems from an inappropriate implementation in Chrome's Paint module. The vulnerability allows a remote attacker to perform UI spoofing by serving a crafted HTML page to a victim. The attack vector is network-based with no authentication required, but does require user interaction (UI:R). The impact is limited to integrity—specifically the integrity of the visual interface presented to the user—with no confidentiality or availability impact. The root cause maps to CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating that critical security or functional information is being obscured or misrepresented by attacker-controlled content.

Business impact

UI spoofing vulnerabilities can undermine user trust in browser security indicators. Attackers may use this to deceive users into believing fake security warnings, phishing pages, or convincing mock login screens are legitimate. The business impact includes increased risk of credential compromise, phishing success rates, and brand damage if users are deceived while using Chrome. For organizations, this affects end-user security awareness and can weaken defenses against social engineering attacks targeting employees.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. All platforms running vulnerable Chrome versions are at risk—Windows, macOS, Linux, Android, and iOS. Enterprise deployments and personal users on older Chrome versions are in scope. Organizations with auto-update disabled or those on extended release cycles may remain vulnerable longer.

Exploitability

Exploitability is moderate. The attack requires a network vector and user interaction—specifically, a user must visit a crafted HTML page. No special privileges are needed on the victim's system, and the attacker does not need to authenticate. The simplicity of serving a malicious webpage combined with the low bar for user interaction (clicking a link, opening a bookmark) makes this practical for phishing campaigns and watering hole attacks. However, because it requires conscious user action, it is less severe than fully automatic exploitation.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Verify the update is applied by checking chrome://version in the browser. Organizations should enforce auto-updates where possible and monitor Chrome versions in use across the fleet. For users on manual update cycles, prioritize this patch to close the UI spoofing window, particularly if your organization faces targeted phishing or social engineering campaigns.

Patch guidance

Patches are available in Chrome 150.0.7871.47 and subsequent releases. Most users on auto-update will receive the fix automatically. Verify successful patching by navigating to chrome://version and confirming the version number is 150.0.7871.47 or higher. For enterprise Chrome deployments managed via policy, ensure update policies permit immediate deployment. No rollback is necessary; only forward updates to patched versions are required. Test compatibility with critical web applications after updating, though this is a UI-layer fix with minimal risk of breaking compatibility.

Detection guidance

Detection of exploitation is challenging because the attack manifests as visual deception rather than system-level compromise. Monitor for unusual HTML delivery patterns in web traffic and watch for users reporting suspicious Chrome interface behavior or encountering unexpected warnings. Endpoint detection tools may log unusual rendering or paint operations, though these are typically benign. The best detection is user reporting of suspicious interface elements. Educate users to verify security warnings by checking Chrome's official status indicators and to avoid clicking on unexpected security prompts. Review browser version telemetry to identify outdated Chrome instances still in use.

Why prioritize this

Although the CVSS score is 4.3 (Medium), this vulnerability warrants prompt patching because: (1) it targets the user interface—the primary trust boundary between user and browser; (2) it enables social engineering and phishing at scale; (3) deployment is trivial (crafted HTML page); (4) it affects all Chrome users regardless of platform. The lack of KEV status does not diminish the practical risk. Organizations with high phishing volumes or targeted threats should treat this as a priority update rather than a routine patch cycle item.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects that the attack is remotely accessible with low complexity and no authentication, but requires user interaction and has limited impact (integrity only, no confidentiality or availability). The score does not fully capture the social engineering risk or the fact that UI spoofing can be a stepping stone to credential compromise. In the context of active phishing campaigns or targeted attacks, the practical risk may exceed the base score. Organizations should consider context—threat landscape, user training, and attack history—when deciding whether to treat this as Medium or escalate priority.

Frequently asked questions