CVE-2026-13867: Google Chrome XSS Vulnerability

CVE-2026-13867 Overview

CVE-2026-13867 affects Google Chrome versions prior to 150.0.7871.47. The flaw resides in the browser's Geolocation implementation and allows a remote attacker to perform user interface (UI) spoofing through a crafted HTML page. Chromium's internal severity rating for this issue is Medium. The vulnerability is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information).

Exploitation requires user interaction, such as visiting an attacker-controlled web page. Successful abuse can mislead users about the origin or nature of a geolocation prompt, undermining the trust cues browsers rely on to convey security-relevant context.

Critical Impact
A remote attacker can craft an HTML page that misrepresents Chrome's geolocation UI, deceiving users into approving location access or misinterpreting the requesting origin.

Affected Products

Google Chrome desktop versions prior to 150.0.7871.47
Chromium-based browsers inheriting the vulnerable Geolocation component
Any deployment relying on Chrome's unpatched Stable channel builds

Discovery Timeline

2026-06-30 - CVE-2026-13867 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13867

Vulnerability Analysis

The issue is an inappropriate implementation within Chrome's Geolocation subsystem. Geolocation prompts must faithfully communicate the requesting origin and the sensitivity of the permission being granted. When the UI can be manipulated by page content, users lose the visual assurance that browser chrome normally provides.

Because the flaw is a UI misrepresentation defect rather than a memory safety issue, exploitation does not yield code execution. Instead, it enables deception attacks against the human decision layer. Attackers can leverage this weakness in phishing, tracking, or social engineering campaigns that abuse location data.

The CVSS vector indicates network-based delivery, low attack complexity, no privileges required, and required user interaction. Confidentiality and availability are unaffected, while integrity is impacted at a limited scope due to the spoofed UI element.

Root Cause

The root cause is an implementation defect in how Chrome renders or scopes elements associated with geolocation permission dialogs. The Chromium project tracks the underlying defect in the Chromium Issue Tracker Entry. The behavior violates the browser's trust boundary between page content and privileged UI surfaces.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim into visiting it. The page manipulates layout, timing, or overlay behavior around the geolocation prompt to produce a misleading representation. The victim's interaction with the spoofed UI may result in unintended permission grants or misplaced trust in the page's origin.

No verified public exploit code is available for CVE-2026-13867. The vulnerability is described in prose based on the vendor advisory; readers can consult the Google Chrome Update Announcement for release-level detail.

Detection Methods for CVE-2026-13867

Indicators of Compromise

Chrome browser instances reporting a version string below 150.0.7871.47 in enterprise inventory data
Web proxy or DNS logs showing visits to newly registered or low-reputation domains that request geolocation permissions
User reports of unexpected geolocation prompts or prompts whose displayed origin does not match the visible page

Detection Strategies

Query endpoint inventory for outdated Chrome versions and correlate with browsing telemetry from the same hosts
Inspect HTTP archives and response bodies for pages that call navigator.geolocation.getCurrentPosition alongside iframe or overlay constructs targeting the permission bubble
Alert on repeated permission prompts served from ad networks or redirect chains that terminate on unknown origins

Monitoring Recommendations

Ingest browser version telemetry and web proxy logs into a centralized analytics platform to identify vulnerable populations
Track user-reported phishing incidents that reference location prompts and pivot on the source URL
Monitor Google's Google Chrome Update Announcement feed for follow-up advisories in the same component

How to Mitigate CVE-2026-13867

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later across all managed endpoints
Force-restart Chrome after deployment so that the patched binary is loaded into active user sessions
Communicate to end users that legitimate geolocation prompts always originate from the browser's built-in permission surface, not from page content

Patch Information

Google addressed the defect in the Stable channel update referenced in the Google Chrome Update Announcement. Chromium-based browser vendors typically incorporate the fix in subsequent releases; administrators should confirm patched builds with each vendor.

Workarounds

Use enterprise policy to set DefaultGeolocationSetting to 2 (Block) where geolocation is not required by business workflows
Restrict geolocation grants to an allowlist of trusted origins using the GeolocationAllowedForUrls policy
Train users to close and re-navigate to a site directly when a geolocation prompt appears in an unexpected context

bash

# Chrome enterprise policy example (Linux JSON policy)
{
  "DefaultGeolocationSetting": 2,
  "GeolocationAllowedForUrls": [
    "https://maps.example.com",
    "https://fleet.internal.corp"
  ]
}