CVE-2026-13989: Google Chrome PageInfo UI Spoofing Vulnerability (Medium)

Technical summary

CVE-2026-13989 stems from an inappropriate implementation in Chrome's PageInfo component. The vulnerability requires two conditions: (1) the attacker must first compromise the renderer process, typically through a separate vulnerability or attack vector, and (2) the user must interact with a crafted HTML page served by the attacker. Once those conditions are met, the attacker can manipulate the PageInfo UI to misrepresent the page's origin, certificate status, or other security indicators. The flaw is classified under CWE-451 (User Interface Inconsistency), reflecting the disconnect between what the browser claims about a page and what is actually true. Chromium's security team rated this as Medium severity.

Business impact

The practical risk depends on whether your users face targeted attacks. If an attacker has already compromised a user's renderer process, they likely have higher-value exploitation goals than UI spoofing alone. However, UI spoofing can amplify damage by convincing users to enter credentials, approve sensitive actions, or trust malicious content they otherwise would not. Organizations handling sensitive transactions or serving high-value targets should prioritize this patch to prevent social engineering attacks that build on renderer compromises.

Affected systems

Google Chrome releases prior to version 150.0.7871.47 are affected. This includes all stable, beta, and development versions of Chrome released before the patch date. Chromium-based browsers that incorporate unpatched versions of Chromium may also be vulnerable; verify your specific Chromium-based browser's patching status against the vendor advisory.

Exploitability

Exploitation requires a high-complexity chain: an attacker must first compromise the renderer process (via a separate vulnerability or social engineering) and then serve a crafted HTML page to the victim. The attack is not wormable and does not spread automatically. No public exploit code or active exploitation in the wild has been reported as of the vulnerability's publication. The CVSS vector reflects these constraints (AC:H, PR:N, UI:R), resulting in a moderate score of 5.3.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will deliver this patch automatically on the next restart cycle; organizations can accelerate deployment by restarting browsers or using device management tools to force immediate updates. No workarounds or configuration changes mitigate this vulnerability—patching is the only remedy.

Patch guidance

Deploy Chrome 150.0.7871.47 or later across your user base. If you manage Chrome via enterprise policy (Chrome Enterprise or similar), use your management console to verify that all managed devices are running the patched version. Monitor your Chrome version compliance for the next 7–14 days to ensure the patch has fully propagated. For organizations on extended release cycles, confirm that your chosen release channel includes this fix before resuming normal operations.

Detection guidance

Monitor for crashes or unexpected behavior in Chrome's PageInfo display following renderer compromise attempts (e.g., suspicious network activity, unusual process injection, or privilege escalation alerts). However, detection of UI spoofing attacks in the wild is difficult without behavioral telemetry or user reporting. Focus instead on ensuring rapid patch deployment as the primary defense. If you operate a security operations center, flag any reports of users encountering misleading browser security indicators as potential UI spoofing attempts and correlate them with other indicators of compromise on those systems.

Why prioritize this

Although the base CVSS score is moderate (5.3), this vulnerability bridges two attack vectors: it assumes a prior renderer compromise and enables subsequent social engineering. Organizations with users at risk of targeted attacks—such as finance, healthcare, government, or high-profile tech employees—should prioritize this patch early in their cycle. The lack of KEV designation and active exploitation suggests this is not an immediate emergency, but the attack complexity is low once prerequisites are met, making timely patching prudent.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects: (1) network-accessible attack surface (AV:N), (2) high attack complexity due to the required renderer compromise (AC:H), (3) no special privileges needed (PR:N), (4) user interaction required (UI:R), (5) no impact on confidentiality (C:N), (6) high impact on integrity through UI spoofing (I:H), and (7) no availability impact (A:N). The moderate score appropriately captures the serious nature of the integrity violation without overstating likelihood, given the hard prerequisite of a prior compromise.

Frequently asked questions