CVE-2026-13987: Chrome Android UI Spoofing Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-13987 stems from improper validation and rendering of Chrome's security UI elements on Android. The vulnerability is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating that security-critical information—such as domain identity, SSL status, or warning dialogs—can be visually spoofed or hidden through malformed HTML. An unauthenticated network attacker can exploit this via a crafted HTML page without requiring the victim to have special system privileges. The CVSS v3.1 score of 4.3 reflects the low attack complexity, low privileges required, and reliance on user interaction, with integrity impact (users trust false UI elements) but no direct confidentiality or availability compromise.

Business impact

This vulnerability primarily threatens user trust and brand reputation. Attackers can craft phishing pages that appear more convincing by mimicking Chrome's own security dialogs or by hiding legitimate warning indicators, increasing the success rate of credential theft and malware distribution campaigns. Organizations that depend on Android Chrome users (e.g., financial services, e-commerce, SaaS providers) may see elevated phishing complaints and account takeovers if users mistake spoofed UI for legitimate security guidance. The impact is amplified for mobile-first or BYOD environments where users may be less familiar with distinguishing genuine UI from fakes on smaller screens.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are affected. This includes all Android variants (Google Play, Samsung, enterprise deployments) and affects both phones and tablets using the vulnerable Chrome version. Desktop Chrome and Chrome on other platforms are not impacted by this specific UI misrepresentation flaw. Users on Chrome 150.0.7871.47 and later are protected.

Exploitability

Exploitability is moderate and practical. The attack requires no network access restrictions—any website can host the malicious HTML—and no authentication or elevated privileges. However, successful exploitation depends entirely on user interaction: the victim must view or interact with the crafted page, and the spoofed UI must be convincing enough to influence their decision-making. The attack does not execute arbitrary code, crash the browser, or bypass sandbox protections; its power lies in social engineering through visual deception. Drive-by downloads, phishing campaigns, and compromise of legitimate websites could amplify delivery at scale.

Remediation

Users should update Google Chrome on Android to version 150.0.7871.47 or later. Updates are typically delivered automatically through Google Play, but manual checking via Settings > About Chrome is recommended to confirm the latest version is installed. Organizations managing Android devices should verify that Chrome auto-update is enabled and consider testing the update in a small cohort before widespread rollout. No workarounds are available beyond updating; disabling Chrome is impractical for most users. Complementary controls such as security awareness training on recognizing UI spoofing and email filtering to reduce phishing delivery can reduce risk while updates are staged.

Patch guidance

Verify your current Chrome version in the browser's About menu; the patch version is 150.0.7871.47. Google Play typically delivers updates automatically within 24-48 hours of release, but users can manually trigger an update check via the Play Store app. Enterprise environments using Chrome Management Cloud console should confirm that the device policy permits auto-update and monitor rollout dashboards. For devices on restricted networks, verify that Chrome has access to Google's update servers. No rollback or beta version workarounds are necessary; this is a stable release patch.

Detection guidance

Direct detection of exploitation attempts is challenging because the vulnerability exploits rendering logic rather than network protocols. Focus detection efforts on: (1) user complaints about suspicious Chrome dialogs or missing address bar indicators, particularly correlated with phishing or credential theft reports; (2) analysis of web server logs for unusual HTML submissions containing Chrome-specific UI spoofing payloads (look for injected HTML that mimics Chrome dialogs or hides UI elements); (3) mobile threat intelligence feeds that catalog phishing pages leveraging Chrome UI misrepresentation. Behavioral signals include spikes in password reset requests or fraud reports following mobile user clicks on suspicious links. Endpoint detection tools may flag malicious HTML patterns if configured with Chrome-specific signatures.

Why prioritize this

Although the CVSS score is medium (4.3), this vulnerability should not be deprioritized. The practical impact—increased phishing and fraud success—is significant for organizations with large Android user bases. The attack is trivially deployable (any attacker with a website can attempt it), and the fix is non-disruptive (a standard Chrome update). Prioritize patching for frontline staff, customer-facing teams, and users in finance/HR roles who are frequent phishing targets. Lower-risk segments can follow standard update schedules, but older devices or those on restricted update channels warrant accelerated attention.

Risk score, explained

The CVSS v3.1 score of 4.3 (Medium) correctly reflects the technical profile: network-based attack, low complexity, no authentication, user interaction required, and integrity impact only. However, context matters: this score understates the real-world threat if your organization's users are targeted by sophisticated phishing campaigns. The lack of confidentiality or availability impact prevents a higher score, but the human element (UI spoofing) makes this more dangerous than a typical medium-severity flaw. Use the CVSS as a baseline and layer in business risk: high user populations on Android, frequent phishing targeting, or sensitive transaction flows all warrant faster patching than the score alone suggests.

Frequently asked questions