CVE-2026-13945: Google Chrome Auth Bypass Vulnerability

CVE-2026-13945 Overview

CVE-2026-13945 is a user interface (UI) spoofing vulnerability in the Extensions component of Google Chrome on Linux. The flaw stems from insufficient policy enforcement and affects Chrome versions prior to 150.0.7871.47. An attacker who convinces a user to install a malicious extension can craft that extension to spoof browser UI elements. This misleads users into trusting attacker-controlled content presented as legitimate browser chrome. Google classifies the Chromium security severity as Medium, and the issue maps to [CWE-451] (User Interface Misrepresentation of Critical Information).

Critical Impact
Successful exploitation lets a malicious Chrome extension misrepresent browser UI on Linux, enabling credential phishing or trust decisions against spoofed interfaces.

Affected Products

Google Chrome on Linux prior to 150.0.7871.47
Linux kernel-based distributions running vulnerable Chrome builds
Chromium-derived browsers sharing the same extension policy code path

Discovery Timeline

2026-06-30 - CVE-2026-13945 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13945

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome on Linux. Chrome enforces policies that constrain how extensions render, overlay, or manipulate browser UI surfaces. Insufficient enforcement of these policies allows a crafted extension to render UI elements that impersonate trusted browser components. The attacker relies on user interaction: the victim must install the malicious extension from a source under attacker influence. Once installed, the extension can present spoofed dialogs, address bar content, permission prompts, or other chrome elements. The confidentiality impact is none, integrity impact is limited, and availability is unaffected, so the primary risk is deception rather than direct code execution.

Root Cause

The root cause is a policy enforcement gap in the Linux build of Chrome's extension handling logic. UI rendering paths accessible to extensions did not consistently validate against constraints intended to prevent overlap or impersonation of trusted browser surfaces. This aligns with [CWE-451], where security-relevant information is misrepresented to the user.

Attack Vector

Exploitation requires the attacker to convince a user to install a malicious Chrome extension on a Linux host. After installation, the extension issues API calls or renders content that mimics browser UI. The user then interacts with the spoofed interface, believing it originates from Chrome or a trusted site. No network privileges beyond standard extension distribution channels are needed, but user interaction is required and attack complexity is high.

No public proof-of-concept exploit is available. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-13945

Indicators of Compromise

Newly installed Chrome extensions on Linux endpoints originating from outside the enterprise-approved extension allowlist
Extensions requesting broad host permissions or tabs, webNavigation, and declarativeNetRequest scopes without business justification
User reports of unexpected permission prompts, address bar behavior, or dialog boxes inside Chrome

Detection Strategies

Inventory installed Chrome extensions on Linux endpoints and compare against an approved list, flagging deviations
Monitor the Chrome extension preferences file at ~/.config/google-chrome/Default/Preferences and the Extensions directory for unauthorized additions
Correlate Chrome process telemetry with browser version data to identify hosts running builds earlier than 150.0.7871.47

Monitoring Recommendations

Alert on Chrome versions below 150.0.7871.47 reported by endpoint inventory tools
Track sideloaded extensions and extensions installed outside the Chrome Web Store
Log and review Chrome enterprise policy events related to extension installation and management

How to Mitigate CVE-2026-13945

Immediate Actions Required

Update Google Chrome on all Linux endpoints to version 150.0.7871.47 or later
Audit currently installed extensions and remove any that are unapproved or unknown
Enforce Chrome enterprise policies that restrict extension installation to a vetted allowlist

Patch Information

Google addressed CVE-2026-13945 in the Chrome Stable channel update to version 150.0.7871.47 for Linux. Refer to the Google Chrome Stable Update advisory for release details and the Chromium Issue Tracker Entry for technical context.

Workarounds

Apply the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to prevent installation of untrusted extensions
Disable extension installation entirely on high-risk systems using ExtensionInstallBlocklist set to *
Train users to install extensions only from vetted sources and to report unexpected UI behavior in the browser

bash

# Configuration example: enforce Chrome extension allowlist via managed policy on Linux
sudo mkdir -p /etc/opt/chrome/policies/managed
sudo tee /etc/opt/chrome/policies/managed/extension_policy.json > /dev/null <<'EOF'
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved-extension-id-1",
    "approved-extension-id-2"
  ],
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked"
    }
  }
}
EOF