CVE-2026-13998: Chrome File Input UI Spoofing on macOS

Technical summary

CVE-2026-13998 addresses an incorrect security UI implementation in Chrome's file input handling mechanism on macOS. The vulnerability stems from improper validation or rendering of security indicators during user interaction with file dialogs (CWE-451: User Interface (UI) Misrepresentation of Critical Information). An attacker-controlled HTML page can trigger UI spoofing by inducing specific user gestures, causing Chrome to display a misleading or fake security interface. This allows the attacker to misrepresent the source or legitimacy of file operations. The flaw affects Chrome versions prior to 150.0.7871.47 on Apple macOS.

Business impact

UI spoofing vulnerabilities create trust erosion risks. Users may be manipulated into downloading malware, granting permissions to untrusted applications, or disclosing sensitive files through fake dialogs that mimic Chrome's genuine security prompts. While this particular flaw requires user interaction and specific gestures (reducing volume), it targets the decision-making layer—users' visual perception of what is safe. For organizations with significant macOS deployments, this represents a social engineering pathway that could be chained with other techniques to compromise end-user devices or extract sensitive data.

Affected systems

Google Chrome on macOS versions prior to 150.0.7871.47 are affected. macOS is listed as an affected platform, indicating the vulnerability is specific to the Chrome browser on Apple's operating system; Windows or Linux versions of Chrome are not mentioned in the advisory. Any macOS user running an unpatched version of Chrome is at risk if they visit a malicious or compromised website that leverages this flaw.

Exploitability

Exploitation requires a remote attacker to host a crafted HTML page and convince a user to visit it. The user must then perform specific UI gestures (such as particular mouse movements or keyboard inputs) to trigger the spoofing behavior. This multi-step requirement—user visit plus specific interaction—raises the barrier compared to purely passive exploits, but does not eliminate risk. Given Chrome's ubiquity and the prevalence of social engineering campaigns, adversaries could incorporate this into broader phishing or drive-by download campaigns. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no active weaponization has been observed or reported as of the publication date.

Remediation

Users and administrators should update Google Chrome on macOS to version 150.0.7871.47 or later as soon as possible. macOS users can enable automatic Chrome updates to streamline patching. For enterprise environments, administrators should verify Chrome update policies are in place and monitor deployment status. Given the CVSS 4.2 score (Medium severity) and lack of KEV listing, this should be prioritized within standard patch windows but does not warrant emergency/out-of-band response.

Patch guidance

Google Chrome will deliver version 150.0.7871.47 or later as a security patch. Users can verify their current version via Chrome Menu > About Google Chrome; the browser will automatically download and stage the update. Administrators managing Chrome via MDM or group policy should confirm that update channels are configured to pull the latest release. For macOS, ensure that system-level Chrome installations are covered by your patch management workflow. Verify the patch by confirming the version string in Chrome's about page shows 150.0.7871.47 or a later version number.

Detection guidance

Monitor for suspicious HTML files, downloads, or links that may trigger unusual file dialogs on macOS. Endpoint telemetry should track Chrome version adoption to ensure patch compliance. Security teams can review browser history or network logs for visits to known malicious domains, though the crafted page itself may not generate distinctive signatures. User reports of unexpected or out-of-place file dialogs—particularly those requesting permissions or file access—should be escalated. EDR tools on macOS endpoints should monitor for unusual file dialog interactions or attempts to exploit UI misrepresentation. Consider user awareness training on verifying dialogs match expected Chrome security styling.

Why prioritize this

This vulnerability merits standard (rather than critical) priority due to its CVSS 4.2 rating, requirement for user interaction and specific gestures, and absence from CISA's KEV catalog. The attack surface is narrower than purely remote exploits. However, it should not be ignored: UI spoofing attacks exploit human psychology and can be effective in targeted campaigns. Organizations with high-value macOS users (executives, developers, researchers) or those in regulated industries should treat this as a near-term patching priority. The low barrier to patch deployment (browser update) also favors swift remediation.

Risk score, explained

The CVSS 3.1 score of 4.2 (Medium) reflects moderate severity: network-exploitable, but requiring high complexity (specific user gestures), no privileges, and user interaction. The impact is limited to integrity and availability (I:L, A:L)—an attacker can misrepresent the UI and potentially cause denial of service or minor integrity violations, but cannot directly access confidential data. The vector (AV:N/AC:H/PR:N/UI:R/S:U) captures that this is a social engineering / trust boundary attack rather than a direct code execution or data exfiltration flaw.

Frequently asked questions