CVE-2026-14013: Chrome SVG UI Spoofing Vulnerability (v150.0.7871.47)

Technical summary

CVE-2026-14013 stems from an inappropriate implementation of SVG rendering in Chrome's browser engine. The vulnerability (CWE-451: User Interface Clickjacking) allows remote attackers to craft HTML pages that leverage SVG to create UI spoofing conditions. The attack requires user interaction (visiting a malicious page) and does not achieve code execution, information disclosure, or system availability impact. The CVSS v3.1 score of 4.3 (Medium) reflects the requirement for user click/navigation and the limitation to integrity impact only (ability to deceive the user).

Business impact

UI spoofing attacks can erode user trust in the browser and web applications, potentially leading to credential theft if users are deceived into entering passwords into fake login forms. While this vulnerability does not directly compromise systems or steal data, it is an integrity concern: users may be misled about which entity they are interacting with. Organizations with security-conscious user bases should still consider this a notable risk, as social engineering via browser UI deception can lower the barrier to credential compromise. The impact scales with user exposure to attacker-controlled web content.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. This includes all release, beta, dev, and canary channels of Chrome on Windows, macOS, Linux, Android, and iOS until they receive the patched version. Chrome's auto-update mechanism means most users should receive patches automatically, but organizations managing Chrome through group policy or institutional deployments should verify patch rollout.

Exploitability

Exploitation requires a remote attacker to host a malicious HTML page and trick a user into visiting it. No special network privileges or pre-authentication are needed. The attack surface is broad because any website an attacker controls or can inject content into (via cross-site scripting vulnerabilities elsewhere) could be weaponized. However, the attack is not weaponized in the wild as of the CVE publication date, and success depends entirely on social engineering—getting the user to visit the page and, in some cases, interact with spoofed UI elements. This keeps the practical exploitability moderate.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Users relying on auto-update should check for updates manually if they have not received the patch within a week of release. Organization administrators deploying Chrome should push the update through their standard patch management procedures. No workarounds exist; patching is the only mitigation.

Patch guidance

Google Chrome auto-updates by default on most platforms. Users can verify their current version by visiting chrome://version and compare it to 150.0.7871.47. If the installed version is below 150.0.7871.47, click the menu button and select 'Update Google Chrome' or 'About Google Chrome' (macOS/Linux) to trigger an update check. For enterprise deployments, use Google Chrome Enterprise for centralized version control and scheduled deployment policies. Verify patch application within 5–7 days post-release to ensure no users remain on vulnerable versions.

Detection guidance

This vulnerability is difficult to detect in real-time without access to page rendering and DOM inspection tools. Security teams should monitor for any user reports of suspicious Chrome dialogs or warning pages they did not expect. Endpoint detection and response (EDR) tools may flag unusual Chrome process behavior if SVG parsing exploits trigger crashes or anomalies. Network-level detection is impractical because the exploit is purely client-side. Encourage users to report suspicious in-browser prompts. Post-patch, verify no unpatched Chrome instances remain via asset inventory tools or mobile device management (MDM) solutions.

Why prioritize this

Despite a CVSS score of 4.3 (Medium), this vulnerability should be prioritized for patching within your standard maintenance windows for the following reasons: (1) Chrome is ubiquitous and exposed to untrusted web content by design; (2) UI spoofing is a proven credential theft vector; (3) patch adoption is typically high due to auto-update, so delaying increases attack surface; (4) the patch is low-risk and does not introduce breaking changes. Place this in your 'patch within 30 days' queue rather than the critical tier, but do not defer indefinitely.

Risk score, explained

The CVSS v3.1 score of 4.3 is appropriate and reflects a medium-risk vulnerability. The score is driven down by the requirement for network access plus user interaction (AV:N/AC:L/PR:N/UI:R) and the absence of confidentiality or availability impact (C:N/I:L/A:N). The single point of integrity impact acknowledges that user trust and correct UI presentation matter, but the overall severity remains moderate because no data is exfiltrated and no systems are compromised. This scoring aligns with the Chromium project's own 'Medium' severity designation.

Frequently asked questions