CVE-2026-13860: Google Chrome XSS Vulnerability

CVE-2026-13860 Overview

CVE-2026-13860 is a user interface spoofing vulnerability in the Autofill component of Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker can craft an HTML page that manipulates Autofill security UI to mislead users into revealing sensitive information or performing unintended actions. Exploitation requires the victim to perform specific UI gestures, which raises attack complexity. Google classifies the Chromium security severity as Medium. The weakness maps to [CWE-451], User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
Attackers can spoof Autofill security prompts through crafted web pages, potentially tricking users into disclosing stored credentials or personal data.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows platforms running vulnerable Chrome builds
Chromium-based browsers reusing the affected Autofill code path

Discovery Timeline

2026-06-30 - CVE-2026-13860 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13860

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill component, which renders UI elements to confirm saving or filling of credentials, addresses, and payment data. The Autofill surface fails to correctly represent security-critical state when a page manipulates layout, focus, or overlay elements. An attacker can construct an HTML page that induces Chrome to display Autofill prompts in a misleading context. Users interpreting a legitimate-looking prompt may authorize data disclosure to an attacker-controlled origin. The issue is a UI misrepresentation weakness rather than a memory safety or code execution flaw, so impact is limited to integrity and availability of user-visible security state.

Root Cause

The root cause is improper representation of critical security information within Autofill UI rendering on Windows. Chrome does not adequately isolate Autofill prompts from attacker-controllable page content, allowing overlay or gesture-driven confusion. This aligns with [CWE-451], where the browser presents information in a manner that does not accurately reflect the underlying security context.

Attack Vector

Exploitation is remote over the network but requires user interaction. The attacker hosts a crafted HTML page and convinces the target to visit it and perform specific UI gestures such as clicks, focus changes, or form interactions. No authentication is required. Successful exploitation yields limited integrity and availability impact on the browser session, with no direct confidentiality loss to browser process memory. Attack complexity is high because the attacker must reliably orchestrate timing and gesture sequences.

No public proof-of-concept exploit is available at the time of publication. Refer to the Chromium Issue Tracker Entry for technical details once the restriction is lifted.

Detection Methods for CVE-2026-13860

Indicators of Compromise

Chrome browser processes on Windows reporting version strings below 150.0.7871.47 in enterprise inventory telemetry.
Web proxy logs showing user navigation to unfamiliar domains immediately followed by Autofill-related form submissions.
User-reported incidents describing Autofill prompts appearing in unexpected locations or contexts.

Detection Strategies

Query endpoint inventory data for installed Chrome versions and flag hosts running builds earlier than 150.0.7871.47.
Correlate browser telemetry with URL reputation feeds to surface visits to pages that trigger Autofill interactions from low-reputation origins.
Monitor for anomalous credential submission patterns following brief page dwell times, which can indicate spoofed prompt interaction.

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize browser version and extension telemetry for SOC review.
Track user-reported phishing and spoofing tickets for references to Autofill prompts and correlate with visited URLs.
Integrate DNS and HTTP proxy logs with SIEM rules that flag suspicious redirects preceding Autofill activity.

How to Mitigate CVE-2026-13860

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 150.0.7871.47 or later using enterprise deployment tooling.
Verify auto-update policies are enabled and not blocked by group policy or proxy restrictions.
Communicate to users the risk of interacting with Autofill prompts on unfamiliar sites until patching completes.

Patch Information

Google addressed CVE-2026-13860 in the Chrome Stable channel release 150.0.7871.47 for Windows. Details are published in the Google Chrome Desktop Update advisory. Chromium-based browser vendors should incorporate the upstream fix and issue corresponding updates.

Workarounds

Disable Chrome Autofill for passwords, addresses, and payment methods via chrome://settings/autofill or enterprise policy until patching is complete.
Deploy the AutofillAddressEnabled and AutofillCreditCardEnabled Chrome Enterprise policies set to false on unpatched fleets.
Restrict browsing to trusted sites through URL filtering while the update is being rolled out.

bash

# Configuration example: disable Autofill via Chrome Enterprise policy on Windows
reg add "HKLM\Software\Policies\Google\Chrome" /v AutofillAddressEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v AutofillCreditCardEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f