CVE-2026-13985: Chrome MediaCapture UI Spoofing Vulnerability

Technical summary

CVE-2026-13985 stems from improper implementation in Chrome's MediaCapture module, which handles audio and video stream operations. An attacker with renderer process access can exploit CWE-290 (Improper Input Validation) and CWE-451 (User Interface Inconsistency) weaknesses to display spoofed UI dialogs or prompts via crafted HTML. The vulnerability does not grant code execution or information disclosure on its own; it is a UI-layer attack that deceives the user into approving actions (such as media permissions) they believe are legitimate. The CVSS 3.1 score of 6.5 reflects medium severity with network attack vector, low complexity, no privilege requirement, and user interaction needed, resulting in integrity impact but no confidentiality or availability loss.

Business impact

The primary business risk is reputational damage and user trust erosion if attackers exploit this to deceive users into granting microphone or camera access under false pretenses. In enterprise settings, this could lead to unauthorized recording of sensitive conversations or visual content if user devices are already compromised. The attack chain requires prior renderer compromise, which reduces the immediate threat but indicates that systems already hosting malicious content are at elevated risk of follow-on attacks. Organizations relying on Chrome's permission model as a security boundary should review their endpoint controls and user awareness training.

Affected systems

All versions of Google Chrome prior to 150.0.7871.47 are affected. This includes Chrome on Windows, macOS, Linux, and Chromium-based browsers using vulnerable code. Organizations running Chrome versions in the 140s and earlier should prioritize validation of their deployment versions.

Exploitability

Exploitability is limited by the requirement that the attacker must first compromise the Chrome renderer process through a separate vector (e.g., a browser exploit, malicious website content, or supply-chain compromise). Once renderer access is achieved, the UI spoofing attack is straightforward to execute and highly effective because it leverages user trust in native-looking dialogs. The attack does not require user technical sophistication beyond clicking approve on a fake permission prompt, making it practical in real-world scenarios where renderer compromise has occurred. No public exploit code or CISA KEV listing indicates this is not yet weaponized at scale, but that status can change as Chrome updates propagate.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This patch addresses the MediaCapture implementation defect and restores proper UI consistency. For enterprise deployments, verify Chrome update policies are enforced and monitor version compliance. No workarounds exist short of disabling MediaCapture functionality, which is impractical for most users.

Patch guidance

Deploy Chrome 150.0.7871.47 or newer across your organization. Chrome's auto-update mechanism handles this automatically for consumer users, but enterprise administrators should verify update rings and forced update policies are active. Check Chrome's release notes for any compatibility concerns with enterprise extensions or web applications. Consider staging the update in a test environment first if your organization runs Chrome Enterprise with custom policies. Verify successful deployment by checking chrome://version on representative machines.

Detection guidance

Monitor for unusual permission grant patterns in browser telemetry—specifically, rapid successive grants of camera or microphone access without explicit user action, or grants from origins known to be malicious. Browser console logs may show script errors related to MediaCapture API misuse. Endpoint detection and response (EDR) tools can flag processes attempting to interact with Chrome's IPC mechanisms abnormally. Network-side indicators are limited since the attack is UI-layer, but monitor for traffic to known malware or exploit kit domains that could lead to initial renderer compromise. User training on recognizing suspicious permission prompts remains the most practical detection aid.

Why prioritize this

This vulnerability merits rapid patching because it enables further compromise following renderer process breach. While it does not directly achieve code execution or data exfiltration, it is a high-confidence vector for social engineering once initial access is obtained. The requirement for prior renderer compromise keeps this at medium severity rather than high, but teams operating in high-adversary environments (finance, government, critical infrastructure) should prioritize it. Patch urgency is elevated because Chrome auto-updates reduce the window for successful exploitation, making this a time-sensitive vulnerability for organizations not keeping pace with updates.

Risk score, explained

The CVSS 6.5 score balances the practical ease of exploitation (once renderer is compromised) against the limited impact scope (UI spoofing, no confidentiality loss). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a network-accessible flaw with low attack complexity and required user interaction, affecting the integrity of user trust and permissions without crossing security boundaries. The score is not higher because the vulnerability is confined to deception rather than unauthorized access to protected resources directly; however, it is not low because successful exploitation reliably leads to permission grant manipulation, which can enable camera or microphone access used in follow-on attacks.

Frequently asked questions