CVE-2026-13984: Google Chrome XSS Vulnerability

CVE-2026-13984 Overview

CVE-2026-13984 is a user interface spoofing vulnerability in the TabStrip component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can craft an HTML page that manipulates security-relevant UI elements in the browser tab area, misleading users about the origin or trust state of displayed content. The flaw maps to [CWE-290] (Authentication Bypass by Spoofing) and [CWE-451] (User Interface Misrepresentation of Critical Information). Google classifies the Chromium security severity as Medium. Exploitation requires user interaction with a malicious page, which limits automated abuse but supports phishing and credential theft scenarios.

Critical Impact
Remote attackers can spoof security indicators in the Chrome TabStrip through a crafted HTML page, enabling phishing and social engineering attacks against users.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers incorporating the vulnerable TabStrip code
Desktop Chrome Stable channel releases before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-13984 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13984

Vulnerability Analysis

The vulnerability resides in the TabStrip, the horizontal bar rendering browser tabs and their associated security indicators. Incorrect handling of tab metadata or rendering state allows a crafted HTML page to influence how security-relevant information appears to the user. The result is a mismatch between what the browser displays and the true security context of the page. Attackers exploit this gap to impersonate trusted sites or hide malicious origins.

UI spoofing does not compromise memory safety or grant code execution. Instead, it undermines the trust signals users rely on to make security decisions, such as evaluating whether a login form belongs to a legitimate site. The vulnerability supports credential harvesting, session token theft, and other social engineering outcomes when chained with a convincing phishing page.

Root Cause

The TabStrip fails to correctly represent security state under specific conditions triggered by attacker-controlled HTML. This mirrors classic [CWE-451] weaknesses where the browser chrome does not accurately reflect the underlying origin or connection state. [CWE-290] applies because the spoofed UI can lead users to authenticate against content they believe is trusted.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to visit it. The page manipulates tab-related rendering behavior so that indicators shown in the TabStrip misrepresent the true page context. No privileges are required and the attack executes across the network, but user interaction is necessary. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for release context.

Detection Methods for CVE-2026-13984

Indicators of Compromise

Chrome browser processes reporting a version below 150.0.7871.47 in enterprise inventory scans
Web proxy logs showing users navigating to newly registered domains hosting login-style content shortly before credential resets
User reports of tabs displaying unexpected titles, favicons, or security indicators inconsistent with the visited URL

Detection Strategies

Query endpoint telemetry for installed Chrome builds and flag hosts running versions earlier than 150.0.7871.47
Correlate DNS and HTTP telemetry with threat intelligence feeds covering phishing infrastructure targeting Chrome users
Monitor authentication systems for credential submissions originating from browser sessions immediately after visits to low-reputation domains

Monitoring Recommendations

Enable browser version reporting through Chrome Enterprise policies and forward inventory data to centralized logging
Alert on repeated user-reported UI anomalies through the help desk workflow
Track outbound traffic to domains recently registered or lacking established reputation, especially those serving HTML with tab manipulation patterns

How to Mitigate CVE-2026-13984

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Push the update through Chrome Enterprise, MDM, or software distribution tooling within the standard patch window
Communicate phishing awareness guidance reminding users to verify the address bar rather than relying on tab indicators alone

Patch Information

Google addressed CVE-2026-13984 in the Chrome Stable channel release 150.0.7871.47. Administrators should reference the Google Chrome Stable Update advisory for the full list of fixes and confirm deployment through Chrome's chrome://settings/help version check or enterprise reporting.

Workarounds

Restart Chrome after updates apply to ensure the patched binary is loaded across all user sessions
Enforce Safe Browsing Enhanced Protection through the SafeBrowsingProtectionLevel enterprise policy to reduce exposure to phishing pages
Restrict access to uncategorized or newly registered domains through web filtering until patch coverage reaches 100 percent

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version