CVE-2026-13996: Google Chrome UI Spoofing Vulnerability (v150.0.7871.47)

Technical summary

CVE-2026-13996 stems from an inappropriate implementation in Chrome's permissions subsystem (CWE-451: User Interface (UI) Misrepresentation of Critical Information). The vulnerability allows remote attackers to craft HTML pages that generate UI spoofing attacks. An attacker can manipulate browser UI elements related to permission dialogs or indicators to deceive users into believing they have granted or denied permissions they did not actually manage. The attack surface is network-based with no authentication required, though user interaction is necessary for exploitation. Chromium has classified this as medium severity.

Business impact

The primary business risk involves user deception and potential unauthorized feature access. While the vulnerability does not directly leak sensitive data or compromise system integrity, it could be leveraged to trick users into believing they've consented to camera, microphone, location, or other sensitive permissions when they have not. For organizations relying on Chrome-based security workflows or those with strict permission policies, this could undermine user trust and compliance controls. Phishing and social engineering campaigns could be enhanced by combining UI spoofing with credential harvesting.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected across all platforms where Chrome runs. This includes Windows, macOS, and Linux installations. Users on older or unpatched versions remain at risk. The vulnerability does not affect other Chromium-based browsers unless they also ship with the vulnerable code path, though vendors of Chromium derivatives should evaluate their own release cycles.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing a user to visit it—a relatively low barrier to entry via email, messaging, or advertisement. The attack does not require special network positioning, valid credentials, or complex browser exploits. However, the spoofing effect is limited to UI misrepresentation; an attacker cannot silently grant permissions or access protected resources without additional attack vectors. Successful exploitation depends entirely on user perception and decision-making, making this a medium-difficulty attack with moderate real-world impact.

Remediation

Patching to Chrome 150.0.7871.47 or later resolves this vulnerability by correcting the permissions implementation. Organizations should prioritize updating Chrome across all managed endpoints. For users unable to patch immediately, defensive measures include disabling unnecessary permissions at the browser level, educating users about verifying permission dialogs, and monitoring for suspicious permission-related activity in logs.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. On Windows, the browser typically auto-updates, but administrators should verify completion. On macOS and Linux, ensure auto-update is enabled or manually check Help > About Google Chrome to trigger an update check. For enterprise deployments using managed Chrome policies, push the update through your configuration management system. Verify patch status by navigating to chrome://version and confirming the version number matches or exceeds 150.0.7871.47.

Detection guidance

Detection at the endpoint level is challenging because legitimate permission prompts and spoofed ones share similar characteristics. Focus on behavioral indicators: monitor for unusual permission-related events in browser logs, track instances where users report seeing unexpected permission dialogs, and correlate permission grants with user behavior patterns. Network-level detection should flag requests to known phishing or malicious domains that host the crafted HTML pages. User education—training employees to verify permission contexts and question unsolicited prompts—remains the strongest detection and prevention measure.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 6.5 (Medium) reflects the attack's dependence on user interaction and its limited scope (UI deception rather than data exfiltration or system compromise). However, it should be prioritized over lower-severity issues because UI spoofing can enable downstream attacks and erode user trust in security controls. Organizations with high-risk user populations (C-suite, finance, HR) or those managing sensitive permission policies should patch sooner.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: Network-based attack vector (AV:N) with low attack complexity (AC:L) and no privilege requirement (PR:N), making initial exploitation accessible. However, the required user interaction (UI:R) and high integrity impact (I:H) combined with no confidentiality or availability loss produce a medium rating. The score appropriately captures that while the vulnerability is easy to trigger, its real-world harm is bounded by user perception and the absence of direct data theft or service disruption.

Frequently asked questions