CVE-2026-13997: Chrome Android UI Spoofing Vulnerability in Extensions

Technical summary

CVE-2026-13997 is an incorrect security UI vulnerability (CWE-451: User Interface (UI) Misrepresentation of Critical Information) in the Chrome browser extension security framework on Android. Versions prior to 150.0.7871.47 fail to properly validate or isolate the visual presentation of extension permission dialogs and security warnings. A remote attacker can serve a crafted HTML page that manipulates the rendering or input handling of the extension security UI, causing it to display false or misleading information about an extension's permissions or status. Exploitation requires user interaction (specific UI gestures) but does not require elevated privileges. The attack surface is the web context, making it accessible from any webpage visited by the victim.

Business impact

This vulnerability poses a phishing and social engineering risk rather than direct system compromise. Users could be deceived into accepting malicious extensions, which may then harvest credentials, track browsing, or execute unwanted actions on the device. For enterprises managing Android devices, compromised extensions could lead to data exfiltration, credential theft, or unauthorized app installations. The impact is primarily integrity-focused (users making wrong decisions based on false UI cues) rather than confidentiality or availability, though downstream consequences could be severe if extensions gain sensitive permissions.

Affected systems

Google Chrome for Android versions prior to 150.0.7871.47 are vulnerable. The flaw is specific to the extension security UI on the Android platform and does not affect Chrome on desktop or other browsers. Any Android user running an affected Chrome version who visits a malicious website is at risk.

Exploitability

Exploitation is moderately challenging. While the vulnerability is remotely accessible over the network and requires no authentication, it demands that the attacker convince a user to perform specific UI gestures (taps, swipes, or other interactions) on a crafted page. This human-interaction requirement raises the bar compared to fully automatic attacks. The CVSS score of 4.2 (Medium) reflects this balance: a real threat, but not trivial to execute at scale. No known public exploits or in-the-wild exploitation have been reported (not listed on CISA's KEV catalog).

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users should check the Google Play Store for the latest version. Organizations managing Android devices via Mobile Device Management (MDM) should deploy this update to all managed Chrome installations as soon as feasible. No workarounds are available; patching is the only mitigation.

Patch guidance

Apply Chrome update 150.0.7871.47 or any subsequent stable release. Users can enable automatic updates in Chrome settings (Menu > Settings > About Chrome) to receive the patch automatically. Enterprise administrators should verify patch deployment through MDM console dashboards and confirm version compliance across the fleet. Post-patch verification should confirm that the extension security UI properly displays warnings and permission prompts without manipulation.

Detection guidance

Monitor Chrome update compliance and version inventory across Android devices in your fleet. Watch for unusual extension installation patterns or user complaints about unexpected browser behavior. If possible, audit extension permissions in managed Chrome instances to identify any unexpected or suspicious extensions that may have been installed via UI spoofing. Network-level indicators are minimal; detection is primarily device-inventory-based. Security teams should review audit logs for anomalous extension grants of sensitive permissions (storage, contacts, location).

Why prioritize this

Although the CVSS score is moderate (4.2), this vulnerability warrants prompt attention because it enables social engineering that users cannot easily detect. Unlike vulnerabilities that require sophisticated technical exploitation, UI spoofing is user-facing deception that can succeed at scale if users trust the visual interface. The Android platform's popularity and the ubiquity of Chrome make this a concern for consumer and enterprise fleets alike. Organizations should prioritize patching based on device inventory and user risk profiles rather than severity score alone.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects: Attack Vector (Network) — exploitable remotely; Attack Complexity (High) — requires specific UI gestures and user convincing; Privileges Required (None) — no auth needed; User Interaction (Required) — user must engage in specific actions; Scope (Unchanged) — impact is confined to the user's Chrome session; Confidentiality (None) — no direct data leak; Integrity (Low) — false extension permissions or misleading UI; Availability (Low) — potential disruption if malicious extension interferes with Chrome. The 'Medium' severity is appropriate: real risk, but not as severe as vulnerabilities with high confidence exploitation or direct credential theft.

Frequently asked questions