CVE-2026-13999: Chrome Extension UI Spoofing Vulnerability (v150.0.7871.47)

Technical summary

The vulnerability stems from insufficient input validation in Chrome's extension handling mechanism (CWE-20). Extensions are permitted to render UI elements without adequate sanitization, enabling a crafted extension to present spoofed interface components that mimic legitimate Chrome dialogs, address bars, or security warnings. The attack surface is limited to users who have already installed the malicious extension, but the lack of validation means once installed, the extension can freely generate deceptive visual elements to trick users into disclosing credentials or performing unintended actions.

Business impact

For most organizations, the risk is moderate. Users tricked by UI spoofing may be manipulated into entering sensitive information, clicking malicious links, or authorizing unintended actions. In environments with weak extension governance, adversaries could combine this with credential theft or social engineering campaigns. The impact is primarily confidentiality-focused (phishing risk) rather than systemic infrastructure compromise.

Affected systems

Google Chrome instances prior to version 150.0.7871.47 are affected. This includes Windows, macOS, and Linux deployments. Organizations using Chrome as their standard browser, particularly those without centralized extension policy enforcement, face higher risk if users can freely install extensions.

Exploitability

Exploitability is moderate. The attack requires user action at multiple stages: first, convincing the user to install a malicious extension (social engineering or supply chain compromise), and second, the user interacting with the spoofed UI. This two-stage requirement limits widespread automated exploitation, but is entirely feasible for targeted phishing or credential harvesting campaigns. The CVSS score of 4.3 reflects the required user interaction and limited scope of impact.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Organizations should also enforce extension policies that restrict installation to approved lists, block installation from untrusted sources, and implement monitoring for suspicious extension behavior. Consider disabling extensions for users who do not require them.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later through your standard update mechanism. Chrome typically auto-updates, but verify completion in high-security environments using configuration management or endpoint detection tools. Test compatibility with critical business extensions before broad rollout, though this patch is primarily a validation fix and should not break legitimate extensions.

Detection guidance

Monitor for recently installed browser extensions, particularly from unknown or unusual sources. Look for extensions requesting unusual permissions (especially UI or content script capabilities). Log and review any extension installations that occur outside your organization's approved extension policy. Endpoint detection and response (EDR) tools can flag suspicious extension installation patterns or unusual Chrome process behavior indicative of UI spoofing attempts.

Why prioritize this

Assign this a moderate priority in your patching schedule. While the CVSS score is low-to-medium and the issue requires user-level installation, it directly enables credential theft and phishing attacks. Organizations with strong extension governance and security-aware users can deprioritize slightly; those with loose BYOD policies, free extension installation, or users at high phishing risk should patch sooner.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no special privileges required (PR:N), but mandatory user interaction (UI:R), unchanged scope (S:U), and limited impact to integrity only (I:L). The score appropriately captures that this is a social-engineering-enabled UI deception issue, not a remote code execution or system-level vulnerability.

Frequently asked questions