CVE-2026-13865: Google Chrome XSS Vulnerability

CVE-2026-13865 Overview

CVE-2026-13865 is an input validation vulnerability affecting the Enterprise component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can perform user interface (UI) spoofing by serving a crafted HTML page to a target user. The flaw is classified as [CWE-20: Improper Input Validation] and requires user interaction to trigger. Successful exploitation does not disclose data or grant code execution, but it can mislead users into trusting spoofed browser UI elements. Google addressed the issue in the stable channel update for desktop.

Critical Impact
Attackers can spoof legitimate Chrome UI to deceive users into revealing credentials or approving unsafe actions, undermining browser trust indicators for phishing and social engineering campaigns.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chrome Enterprise deployments running vulnerable builds
Chromium-based browsers sharing the affected Enterprise component code

Discovery Timeline

2026-06-30 - CVE-2026-13865 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13865

Vulnerability Analysis

The vulnerability resides in the Enterprise component of Google Chrome and stems from insufficient validation of untrusted input processed from web content. An attacker who convinces a user to load a crafted HTML page can manipulate rendered UI elements to misrepresent browser state or origin indicators. The attack vector is network-based and requires user interaction, such as visiting a malicious page or clicking a specially crafted link. Because the flaw affects trust surfaces rather than execution boundaries, the primary risk is deception rather than direct compromise. According to the Chromium project, the security severity is rated Medium. The EPSS probability of exploitation is approximately 0.204%, placing the CVE in the lower percentile of near-term exploitation likelihood.

Root Cause

The root cause is improper handling of untrusted input within the Enterprise-facing rendering or dialog logic. Input from a crafted page is not sufficiently sanitized before it influences UI presentation. This allows the attacker-controlled content to overlap, mask, or imitate legitimate browser chrome and prompts. See the Chromium Issue Tracker Entry for tracking details.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or compromised page in a vulnerable Chrome build. The crafted HTML manipulates rendered UI to spoof trusted indicators such as address bar content, permission prompts, or dialog identity. No authentication is required, and the attack complexity is low. Refer to the Google Chrome Update Announcement for the vendor's release notes.

No verified proof-of-concept code is publicly available. The technical mechanism is documented in the Chromium issue tracker.

Detection Methods for CVE-2026-13865

Indicators of Compromise

Chrome browser versions reported as older than 150.0.7871.47 in enterprise inventory telemetry.
Web proxy logs showing user navigation to newly registered or low-reputation domains hosting suspicious HTML content.
User reports of unexpected browser prompts, permission dialogs, or address bar behavior on legitimate-looking sites.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag versions prior to 150.0.7871.47.
Monitor endpoint DNS and HTTP telemetry for traffic to phishing infrastructure that commonly hosts UI spoofing pages.
Correlate credential submission events with browser navigation to unverified domains to surface likely spoofing attempts.

Monitoring Recommendations

Enable enterprise reporting through Chrome Browser Cloud Management to capture version and policy compliance data.
Ingest browser and proxy logs into a centralized analytics platform to detect anomalous navigation patterns.
Track user-reported phishing submissions and correlate them with Chrome version data to prioritize remediation.

How to Mitigate CVE-2026-13865

Immediate Actions Required

Update all Google Chrome installations to version 150.0.7871.47 or later on Windows, macOS, and Linux endpoints.
Force browser restarts through enterprise policy so pending updates apply on managed devices.
Audit Chrome Enterprise policy deployments to confirm auto-update channels are not disabled.

Patch Information

Google released the fix in the stable channel update for desktop. Administrators should deploy Chrome 150.0.7871.47 or later. Details are available in the Google Chrome Update Announcement.

Workarounds

Restrict browsing to trusted domains through enterprise URL allowlists until patches are deployed.
Deliver user awareness guidance emphasizing verification of address bar contents and permission prompts.
Enable Chrome Safe Browsing Enhanced Protection through group policy to increase interception of malicious pages.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv