CVE-2026-13990: Chrome Windows UI Spoofing Vulnerability – Patch Guidance

Technical summary

CVE-2026-13990 stems from insufficient input validation in the DataTransfer component of Chromium on Windows. The vulnerability allows a compromised renderer process to perform UI spoofing by crafting HTML that bypasses sanitization checks. The attack vector is network-based (remote), requires no privileges, and depends on user interaction (visiting a malicious page). The resulting impact is integrity violation—an attacker can alter what the user perceives on screen—without affecting confidentiality or availability. Chromium's security team classified this as Medium severity.

Business impact

UI spoofing attacks can undermine user trust and enable secondary attacks. An attacker could disguise malicious actions (file downloads, permission grants, credential entry) as legitimate browser behavior, increasing the success rate of social engineering within compromised environments. Organizations relying on Chrome for sensitive workflows should prioritize patching, particularly if employees access high-value applications through the browser. The attack does require renderer compromise first, which somewhat limits the immediate blast radius, but layered defenses are essential.

Affected systems

Google Chrome on Windows versions prior to 150.0.7871.47 are affected. This is a Windows-specific vulnerability in the DataTransfer handling code; Chrome on macOS and Linux are not mentioned in the CVE description. Organizations running older Chrome versions on Windows infrastructure or managed through group policy should inventory their deployed versions immediately.

Exploitability

Exploitation requires two stages: first, the attacker must compromise the Chrome renderer process (often via a separate vulnerability in the browser engine or JavaScript engine), and second, they must deliver a crafted HTML page to the victim. This two-step requirement limits opportunistic exploitation but does not prevent determined attackers, especially in targeted campaigns. The attack is fully remote and requires no special privileges, only user interaction in the form of visiting a webpage.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later on all Windows systems. Organizations can use Chrome's auto-update feature (enabled by default) or enforce updates through group policy using the google.com/chrome/business documentation. Verify completion through the Chrome About menu, which shows the current version and update status. No workarounds are available; patching is the only remediation.

Patch guidance

Deploy Chrome 150.0.7871.47 or later across Windows infrastructure. For enterprise deployments, use Google's Admin console or group policy to enforce updates and set auto-update policies. Test the patched version in a limited environment first to confirm compatibility with internal web applications. Chrome typically auto-updates silently; monitor rollout via your device management tools. Confirm version compliance within 7–10 days of the patch release.

Detection guidance

Detection is difficult because the vulnerability is triggered by user interaction with a malicious webpage that has successfully compromised the renderer. Endpoint detection and response (EDR) tools should monitor for unusual Chrome process behavior (renderer crashes, memory anomalies) that might indicate exploitation attempts. Web proxies can help block known malicious domains, though attackers often use new infrastructure. Security teams should track renderer compromise incidents separately from this UI spoofing layer, as the renderer compromise is often the more critical precursor.

Why prioritize this

Although classified as Medium severity, the integrity impact (UI spoofing) combined with the ease of exploitation post-renderer-compromise makes this a priority for rapid patching. The attack enables social engineering at scale within compromised environments, potentially leading to credential theft or malware execution. The rendering compromise prerequisite prevents this from being a direct, single-stage attack, but it should not delay patching. Windows Chrome users should be treated as a higher-priority patching cohort.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-based attack with low complexity, no privilege requirement, and required user interaction. The lack of confidentiality or availability impact keeps the score below 7.0, but the integrity impact (UI spoofing) is significant because it enables deception. The score appropriately captures the severity as Medium—not critical, but requiring urgent attention in Windows environments, especially where Chrome is heavily used for business-critical tasks.

Frequently asked questions