CVE-2026-13941: Google Chrome XSS Vulnerability

CVE-2026-13941 Overview

CVE-2026-13941 is a user interface (UI) spoofing vulnerability in the SiteSettings component of Google Chrome on Android. Versions prior to 150.0.7871.47 contain an inappropriate implementation that allows a remote attacker to manipulate browser UI elements through a crafted HTML page. Google classifies the Chromium security severity as Medium. The flaw maps to CWE-451: User Interface (UI) Misrepresentation of Critical Information and requires user interaction to succeed. Successful exploitation enables attackers to mislead users into trusting malicious content by misrepresenting site permission indicators or origin information.

Critical Impact
Attackers can craft HTML pages that spoof site settings UI in Chrome for Android, enabling deception around permissions, origins, or trust indicators used in phishing and social engineering campaigns.

Affected Products

Google Chrome for Android prior to 150.0.7871.47
Google Android devices running vulnerable Chrome builds
Downstream Chromium-based mobile browsers sharing the same SiteSettings implementation

Discovery Timeline

2026-06-30 - CVE-2026-13941 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13941

Vulnerability Analysis

The vulnerability resides in Chrome's SiteSettings surface, which renders origin-scoped permission and trust information to users. An inappropriate implementation allows a crafted HTML page to influence how this UI is displayed. The attack is network-reachable and requires no privileges, but the user must interact with the malicious page for exploitation to occur. The impact is limited to integrity of displayed information. Confidentiality and availability are not directly affected. Because the flaw undermines visual trust indicators, it is well suited for chaining with phishing kits that mimic banking, enterprise SSO, or messaging services.

Root Cause

The root cause is improper handling of state or content rendering within SiteSettings on Android [CWE-451]. Chromium engineers addressed the defect in commit series tied to Chromium issue 513183855. The underlying implementation fails to strictly bind displayed origin or permission context to the actual active security principal, letting attacker-controlled HTML alter what the user perceives.

Attack Vector

An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it through a link, ad, or messaging redirect. When the victim interacts with the page, the malicious content triggers the flawed SiteSettings behavior, producing spoofed UI. The attacker uses the misrepresented interface to convince the victim to grant permissions, submit credentials, or trust an origin. No memory corruption or code execution occurs; the exploit is purely visual deception delivered through standard web content.

See the Chromium Issue Tracker Entry for implementation-level details once Google unrestricts the report.

Detection Methods for CVE-2026-13941

Indicators of Compromise

Mobile Chrome user-agent strings reporting versions earlier than 150.0.7871.47 after the patch release
Inbound HTML payloads that invoke SiteSettings-related surfaces or repeatedly request permission prompts from unusual origins
User reports of mismatched origins in address bar versus permission dialogs on Android Chrome

Detection Strategies

Inspect web proxy and DNS logs for Android clients visiting newly registered domains that host permission-heavy HTML pages
Correlate Android EMM or MDM telemetry with Chrome version data to surface devices running vulnerable builds
Monitor phishing intelligence feeds for lures paired with Chrome-for-Android exploitation patterns

Monitoring Recommendations

Track Chrome version distribution across managed Android endpoints and alert when devices remain below 150.0.7871.47
Ingest browser and mobile telemetry into a centralized data lake for cross-source correlation with phishing and credential theft signals
Enable user reporting workflows so employees can escalate suspicious permission prompts or address bar anomalies

How to Mitigate CVE-2026-13941

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Push mandatory Chrome updates through mobile device management (MDM) for corporate-owned and BYOD Android fleets
Communicate phishing awareness guidance highlighting that permission prompts and site indicators may be spoofed on unpatched clients

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Update Announcement for the official advisory and to the Chromium Issue Tracker Entry for the underlying bug reference. Chrome for Android auto-updates via Google Play; enterprises using managed configurations should verify the minimum version policy enforces 150.0.7871.47 or higher.

Workarounds

Restrict browsing to trusted sites through mobile browser policies until affected devices are patched
Disable or tightly scope site permissions such as notifications, geolocation, and camera on Android Chrome via enterprise policy
Advise users to deny permission prompts from unfamiliar origins and to verify the address bar before granting access

bash

# Enforce minimum Chrome for Android version via Managed Google Play app config
# Example JSON policy fragment applied through your EMM/MDM console
{
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com", "https://accounts.google.com"],
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "MinimumChromeVersion": "150.0.7871.47"
}