CVE-2026-13994: Chrome Android Credential UI Spoofing Vulnerability – What You Need to Know

Technical summary

CVE-2026-13994 stems from an inappropriate implementation in Chrome's Credential Management subsystem on Android. The vulnerability exploits insufficient validation or isolation of UI elements, permitting a remote attacker to craft HTML that spoofs legitimate credential-related UI. By serving this malicious content, an attacker can render fake authentication prompts that visually mimic genuine Chrome dialogs. The underlying issue is classified as CWE-451 (User Interface Inconsistency), reflecting the gap between what the user perceives and what the browser actually controls. This flaw was resolved in Chrome version 150.0.7871.47 and later.

Business impact

For organizations managing Android devices and Chrome deployment, this vulnerability presents a social engineering vector. Mobile device users are particularly susceptible to UI spoofing because small screens and varying app designs make it harder to distinguish legitimate from fake prompts. A compromised credential could grant attackers access to corporate email, VPNs, SaaS platforms, or other services reliant on phished authentication. While the CVSS score is moderate (4.3), the business risk depends on your organization's reliance on Android Chrome for accessing sensitive systems and the awareness level of your user population.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. This includes all stable, beta, and dev channel releases below that threshold. Desktop Chrome and Chrome on other platforms are not impacted by this specific flaw. Android users running Chrome should prioritize updating to version 150.0.7871.47 or later. Organizations managing Android devices through MDM should verify minimum Chrome version policies are enforced.

Exploitability

Exploitability is straightforward in execution but requires user interaction. An attacker must trick a user into visiting a malicious website (via phishing email, social media, or other means), then serve a crafted HTML page that spoofs Chrome's credential UI. No browser plugin, extension, or special privilege is needed. However, this is not a zero-click vulnerability—the user must navigate to the attacker's site. The lack of KEV inclusion suggests either limited public exploit activity at time of disclosure or a lower real-world threat density compared to other flaws.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. For enterprise environments, configure MDM policies to enforce automatic updates or block older versions. End users should enable automatic updates in the Google Play Store settings. Additionally, user awareness training on recognizing phishing attempts and validating authentication prompts can reduce the likelihood of successful exploitation.

Patch guidance

Google has patched this issue in Chrome 150.0.7871.47. Users and administrators should verify their current Chrome version in Settings > About Chrome (or About Google Chrome, depending on device). If automatic updates are not enabled, open Google Play Store, navigate to Chrome, and manually trigger an update. Organizations with MDM control should update their minimum Chrome version policy and monitor device compliance reporting to ensure no devices remain on vulnerable releases.

Detection guidance

Detection is challenging without application-layer monitoring or user reporting. Network-based intrusion detection is unlikely to flag this as it relies on HTML content trust issues rather than network exploitation. Monitor for users reporting suspicious credential prompts or unexpected authentication requests. Endpoint detection and response (EDR) tools on Android devices could flag suspicious browser process behavior if available. User education and reporting mechanisms are more practical: establish a clear process for users to report unusual authentication dialogs and verify whether Chrome auto-update is functioning across your fleet.

Why prioritize this

Although the CVSS score is moderate (4.3) and this is not a KEV entry, prioritize patching for organizations with significant Android Chrome usage, particularly in industries handling sensitive data (finance, healthcare, government). The vulnerability's reliance on user interaction and spoofing of UI make it a prime target for social engineering campaigns targeting your organization specifically. Mobile workforce environments and BYOD programs elevate risk. Phishing resilience, not just patch velocity, is critical here.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity rating: the attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges are required (PR:N), but user interaction is necessary (UI:R). Confidentiality is not impacted (C:N), but integrity is affected (I:L)—the attacker can mislead the user or manipulate their perception of security state. Availability is unaffected (A:N). The score appropriately captures that while the attack is easy to launch and can fool users, the direct system compromise is limited. However, integrity of the user's trust model and potential downstream credential compromise elevate practical risk beyond the numerical score.

Frequently asked questions