CVE-2026-13956: Google Chrome XSS Vulnerability

CVE-2026-13956 Overview

CVE-2026-13956 is a user interface spoofing vulnerability affecting Google Chrome versions prior to 150.0.7871.47. The flaw resides in the PageInfo component, which displays security and site information to users. A remote attacker who convinces a user to perform specific UI gestures can spoof the security UI through a crafted HTML page. Chromium classifies the severity as Medium, and the vulnerability is tracked under [CWE-451] User Interface Misrepresentation of Critical Information. The issue enables phishing-style deception by misrepresenting site identity or connection trust indicators in the browser.

Critical Impact
Attackers can misrepresent site security indicators in Chrome's PageInfo surface, enabling convincing phishing and credential theft against users who trust the displayed UI cues.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers inheriting the affected PageInfo component
Desktop Stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-13956 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13956

Vulnerability Analysis

The vulnerability affects Chrome's PageInfo bubble, the UI element accessible via the site controls icon in the address bar. PageInfo communicates connection security, certificate details, and site permissions to users. Incorrect handling of specific UI gestures allows a crafted HTML page to influence what PageInfo displays, breaking the integrity of security signals users rely on to judge site trust.

Exploitation requires user interaction. The attacker must convince the target to perform particular UI actions on a malicious page. The attack complexity is high because the timing and sequence of gestures must align with the browser's rendering of PageInfo. Successful exploitation does not disclose data directly but weakens the trust boundary between the browser chrome and web content.

The practical outcome is UI spoofing. An attacker can present misleading site identity or connection security information, increasing the likelihood that a victim submits credentials, downloads malware, or approves permissions on a page they would otherwise reject.

Root Cause

The root cause is improper isolation between web-controlled content and the browser's PageInfo rendering surface. The PageInfo view rendered state incorrectly under specific gesture sequences, allowing web content to influence what should be a trusted browser-only UI element. This maps to [CWE-451], which covers user interface misrepresentation of security-critical information.

Attack Vector

The attack is network-based and delivered through a malicious or compromised website. The attacker hosts a crafted HTML page and lures a victim through phishing, malvertising, or a compromised link. Once the page loads, the attacker prompts the user to click, hover, or interact with specific elements. These gestures trigger the spoofed PageInfo state, presenting false security indicators to the user.

Exploitation of CVE-2026-13956 requires user interaction and reliable social engineering. There is no evidence of public exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for restricted technical details once access is granted by the Chromium security team.

Detection Methods for CVE-2026-13956

Indicators of Compromise

Browser telemetry showing users on Chrome builds earlier than 150.0.7871.47 visiting unfamiliar domains that trigger repeated PageInfo interactions
Web proxy logs recording HTML pages that programmatically encourage users to click site info or lock icons
Endpoint logs showing credential submission to domains that do not match the certificate presented in Chrome's PageInfo history

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 150.0.7871.47 for prioritized update
Correlate phishing report submissions with Chrome version data to identify users on unpatched builds
Inspect proxy and DNS telemetry for newly registered domains that host pages designed to trigger UI interactions before credential entry

Monitoring Recommendations

Enable browser management policies that report installed Chrome version to a central console
Forward browser and endpoint telemetry into a SIEM to alert on outdated Chrome versions accessing sensitive applications
Track user-reported phishing incidents against browser version data to identify exploitation attempts targeting this UI weakness

How to Mitigate CVE-2026-13956

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force restart of Chrome processes after update to ensure the patched binary is loaded
Verify update deployment status through enterprise browser management or endpoint configuration tools

Patch Information

Google addressed CVE-2026-13956 in the Stable channel release for desktop announced on the Chrome Releases blog. Administrators should deploy Chrome 150.0.7871.47 or newer. Full details are available in the Google Chrome Stable Update advisory.

Workarounds

Educate users to verify URLs directly in the address bar rather than relying solely on PageInfo indicators
Enforce Safe Browsing Enhanced Protection through Chrome enterprise policy to increase warnings on suspicious sites
Restrict browsing to allow-listed domains for users handling sensitive credentials until patch deployment completes

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version