CVE-2026-13978 Overview
CVE-2026-13978 is a user interface spoofing vulnerability in the PageInfo component of Google Chrome versions prior to 150.0.7871.47. The flaw stems from insufficient policy enforcement, allowing a remote attacker to manipulate PageInfo dialog behavior through a crafted HTML page. Successful exploitation requires user interaction, typically visiting an attacker-controlled site. Chromium classifies the security severity as Medium, and Google addressed the issue in the Stable Channel update. The vulnerability is tracked as [CWE-451: User Interface (UI) Misrepresentation of Critical Information].
Critical Impact
Attackers can misrepresent site security information in the PageInfo dialog, enabling phishing and social engineering attacks against Chrome users who rely on browser UI cues to validate site trust.
Affected Products
- Google Chrome versions prior to 150.0.7871.47
- Chromium-based browsers sharing the same PageInfo implementation
- Desktop Stable Channel builds across Windows, macOS, and Linux
Discovery Timeline
- 2026-06-30 - CVE-2026-13978 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13978
Vulnerability Analysis
The PageInfo component in Chrome renders the security and permission summary shown when a user clicks the site information icon in the address bar. This dialog communicates certificate status, connection security, and per-origin permissions. CVE-2026-13978 arises from insufficient policy enforcement within this component, permitting a crafted HTML page to influence how information is displayed.
Because the PageInfo dialog is a trust anchor for users evaluating site legitimacy, spoofing its contents undermines the visual signals that distinguish authentic sites from malicious ones. The exploit path is network-reachable and requires the target to interact with a crafted page. Confidentiality and availability are not impacted, but integrity of the security UI is degraded.
Root Cause
The defect maps to [CWE-451] and reflects missing or inadequate policy checks that gate what a web page can trigger or influence in the PageInfo surface. Without strict enforcement, an attacker's page can induce UI states that misrepresent security posture to the user.
Attack Vector
Exploitation is remote and occurs when a victim loads attacker-controlled HTML in a vulnerable Chrome build. The attacker crafts page content and behavior such that the PageInfo dialog conveys misleading information about the origin, connection, or permissions. Follow-on impact typically involves credential theft, malware delivery, or consent to elevated site permissions.
No public proof-of-concept has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Additional technical context is available in the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-13978
Indicators of Compromise
- Chrome desktop clients reporting a version string below 150.0.7871.47 in browser telemetry or User-Agent logs.
- Outbound connections to newly registered domains hosting HTML pages that reference PageInfo-related DOM manipulation patterns.
- User reports of mismatches between the address bar origin and the security details shown in the site information dialog.
Detection Strategies
- Inventory endpoint browser versions and flag hosts running Chrome builds prior to 150.0.7871.47.
- Correlate web proxy logs with threat intelligence feeds tracking phishing infrastructure that abuses browser UI spoofing weaknesses.
- Monitor endpoint process telemetry for Chrome child processes loading suspicious URLs immediately before credential submission events.
Monitoring Recommendations
- Enable browser management reporting to surface version drift and pending update states across the fleet.
- Alert on user-reported phishing incidents referencing legitimate-looking Chrome security indicators.
- Track DNS and HTTP telemetry for high-volume access to lookalike domains that could pair with UI spoofing.
How to Mitigate CVE-2026-13978
Immediate Actions Required
- Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints.
- Force-restart Chrome sessions after deployment to ensure the patched binary is loaded into memory.
- Verify enterprise policies enforce automatic updates and restrict version rollback.
Patch Information
Google released the fix in the Stable Channel update covered in the Chrome Stable Channel Update. Enterprises using Chrome Browser Cloud Management or group policy should confirm the rollout has reached all update rings. Chromium-derivative browsers should apply the upstream commit once merged into their release branches.
Workarounds
- Where immediate patching is not possible, restrict browsing to trusted sites via web filtering and enterprise allowlists.
- Reinforce user awareness on validating URLs directly in the address bar rather than relying on PageInfo dialog contents.
- Deploy phishing-resistant authentication such as FIDO2 to reduce the impact of successful UI spoofing.
# Verify the installed Chrome version meets the patched baseline
google-chrome --version
# Expected output: Google Chrome 150.0.7871.47 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
