CVE-2026-13895: Google Chrome XSS Vulnerability

CVE-2026-13895 Overview

CVE-2026-13895 is a user interface spoofing vulnerability in the Autofill component of Google Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation that allows a remote attacker to manipulate the browser's Autofill UI. Exploitation requires the attacker to convince a user to perform specific UI gestures on a crafted HTML page. The Chromium project rates this issue as Medium severity, and it is categorized under [CWE-451] User Interface Misrepresentation of Critical Information. No public exploit or CISA Known Exploited Vulnerabilities listing exists for this issue at the time of publication.

Critical Impact
Attackers can spoof the Autofill UI to trick users into disclosing saved form data such as addresses, payment details, or credentials through crafted web pages.

Affected Products

Google Chrome desktop versions prior to 150.0.7871.47
Chromium-based browsers that inherit the Autofill component before applying the upstream fix
Any operating system platform where the vulnerable Chrome build is installed (Windows, macOS, Linux)

Discovery Timeline

2026-06-30 - CVE-2026-13895 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13895

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which presents saved user data such as addresses, payment cards, and form values in a browser-rendered dropdown. An inappropriate implementation allows a malicious page to influence the position, timing, or context of that UI so it misrepresents which site or field is receiving input. The attacker must convince the user to perform specific gestures such as clicks, taps, or keyboard interactions, which raises the attack complexity. Successful exploitation results in limited confidentiality and integrity impact because the user may submit sensitive data into an attacker-controlled context without recognizing the deception. Because Autofill data often includes personally identifiable information and payment details, spoofing attacks against this component are attractive for phishing and fraud operations.

Root Cause

The root cause is a logic flaw in how the Autofill component renders and validates its UI overlay relative to underlying page content. The implementation does not sufficiently isolate the trusted browser UI from attacker-controlled DOM state, enabling misalignment or misrepresentation of the interaction target. This behavior maps to [CWE-451], where the security-relevant UI does not accurately reflect the operation the user is authorizing.

Attack Vector

Exploitation occurs over the network through a crafted HTML page delivered via a link, advertisement, or compromised site. The attacker must lure the victim into executing specific UI gestures within the page. No authentication is required, but user interaction is mandatory, and the attack complexity is high due to the choreographed gesture sequence needed for a reliable spoof.

No verified proof-of-concept code has been published for this vulnerability. Refer to the Chromium Issue Tracker Entry for technical background as it becomes public.

Detection Methods for CVE-2026-13895

Indicators of Compromise

Browser telemetry showing Chrome versions below 150.0.7871.47 accessing untrusted or newly registered domains
Web proxy logs revealing users visiting pages that host high-density autofill form fields combined with overlay elements or transformed iframes
User reports of Autofill dropdowns appearing over unexpected fields or on unfamiliar sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 150.0.7871.47
Monitor outbound HTTP requests for form submissions to domains that do not match the visible page origin, which can indicate spoofed Autofill capture
Correlate browsing history with phishing threat intelligence feeds to identify sessions that visited crafted pages

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Enterprise policies to capture version and extension telemetry
Forward browser and endpoint logs to a centralized analytics platform to identify anomalous Autofill submission patterns
Track user-reported phishing incidents that reference forms auto-populated with saved data

How to Mitigate CVE-2026-13895

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed desktops
Verify that automatic updates are enabled and functioning by checking chrome://settings/help on representative endpoints
Communicate awareness guidance to users about verifying the site origin before accepting Autofill suggestions on unfamiliar pages

Patch Information

Google released the fix in the Stable channel update covered in the Chrome Release Update Blog. Enterprises using Chrome Browser Enterprise should push the update through their existing management channel or allow Google Update to apply the patch automatically. Chromium-derived browsers should apply the corresponding upstream commit referenced in the Chromium Issue Tracker Entry.

Workarounds

Disable Autofill for addresses and payment methods through Chrome policy settings AutofillAddressEnabled and AutofillCreditCardEnabled until patching is complete
Restrict browsing to allowlisted domains for users who handle sensitive payment or identity data
Deploy phishing-resistant browsing controls and user training that emphasize verifying the URL before submitting saved form data

bash

# Configuration example: disable Autofill via Chrome Enterprise policy on Linux
sudo tee /etc/opt/chrome/policies/managed/disable_autofill.json > /dev/null <<EOF
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false
}
EOF