CVE-2026-13995: Chrome Android Autofill UI Spoofing Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-13995 is an insufficient input validation vulnerability (CWE-20) in the autofill subsystem of Google Chrome on Android. Prior to version 150.0.7871.47, a remote attacker can craft a malicious HTML page that exploits how the browser renders autofill UI elements. The vulnerability permits UI spoofing, meaning an attacker can overlay, substitute, or misrepresent visual elements to create a convincing phishing or credential-harvesting interface. The CVSS 3.1 score of 4.3 (Medium) reflects the requirement for user interaction and the integrity impact limited to visual deception rather than confidentiality or availability breaches.

Business impact

The primary risk is phishing and social engineering. Attackers can host crafted pages that trick users into entering credentials or sensitive information into spoofed autofill dialogs. For organizations managing Android devices—especially BYOD environments or contractors using personal devices—this increases the likelihood of credential compromise. The impact is indirect: if an employee is tricked into revealing login credentials via a spoofed autofill prompt, downstream account takeover and lateral movement become possible. The low severity score means this is not a critical infrastructure threat, but it does widen the attack surface for credential theft campaigns.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are vulnerable. The vulnerability is specific to the Android platform; desktop and iOS versions are not affected by this particular issue. Any user of an older Chrome build on Android with autofill enabled is potentially at risk, making this a broad but platform-specific concern for mobile-centric organizations.

Exploitability

The vulnerability requires user interaction—specifically, a user must visit a crafted HTML page and interact with the autofill mechanism. There is no requirement for authentication or special system privileges. The attack is straightforward to execute from the network (no local access needed), and the technical complexity is low. However, the attacker must successfully socially engineer a user into visiting a malicious page and engaging with the autofill UI, which adds friction. The vulnerability is not known to be exploited in the wild or included in public exploit databases, and it does not appear on the CISA Known Exploited Vulnerabilities catalog, suggesting active exploitation is not widespread.

Remediation

Users and administrators should update Google Chrome on Android devices to version 150.0.7871.47 or later. For IT teams managing fleets of Android devices, this typically involves ensuring automatic updates are enabled or pushing updates through Mobile Device Management (MDM) solutions. There are no known workarounds short of disabling autofill entirely, which is not practical for most users. Verify the installed Chrome version via Settings > About Chrome and confirm the update has been applied.

Patch guidance

Google released a patch in version 150.0.7871.47 addressing the insufficient input validation in autofill. Organizations should prioritize deployment in the following order: (1) users with administrative access and elevated privileges, (2) users handling sensitive credentials or accessing high-value accounts, and (3) general user population. For Android MDM environments (Intune, MobileIron, etc.), configure policies to enforce Chrome updates or pin the minimum version requirement. Test the patch on a sample device first to rule out compatibility issues with specific Android versions or enterprise applications that may depend on autofill functionality.

Detection guidance

Detection is challenging because the vulnerability operates at the UI layer and does not generate obvious network or system-level artifacts. Endpoint Detection and Response (EDR) tools running on Android devices may identify visits to known phishing domains or unusually high rates of credential entry followed by suspicious login attempts from new IP addresses. Monitor for: (1) authentication alerts showing logins from unexpected devices or locations shortly after Android device activity, (2) user reports of autofill showing unexpected fields or layout, and (3) anomalous Chrome behavior (crashes, hangs) when interacting with certain pages. A post-breach indicator would be compromised credentials used immediately after a user visited a suspicious webpage on an Android device.

Why prioritize this

Although the CVSS score is low (4.3/Medium), this vulnerability should be patched in a standard update cycle rather than treated as critical. Prioritization depends on organization risk profile: financial services, government, and contractor organizations handling sensitive credentials should patch faster. The vulnerability's reliance on social engineering means user awareness training complements patching. Because no active exploitation is known and the barrier to exploitation includes user interaction, this does not warrant emergency response but should not be delayed beyond the normal quarterly or bi-monthly patch schedule.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the following: Network accessibility (AV:N) and low attack complexity (AC:L) increase risk; however, the requirement for user interaction (UI:R) significantly reduces it. The attack has no confidentiality impact (C:N), limited integrity impact (I:L) because it affects only visual presentation, and no availability impact (A:N). The scope is unchanged (S:U), so the attacker cannot escalate to other security boundaries. The Medium severity rating accurately captures a real but contained threat—credential harvesting is a genuine risk, but the attack surface is narrower than a remote code execution or full authentication bypass.

Frequently asked questions