CVE-2026-13985: Google Chrome XSS Vulnerability

CVE-2026-13985 Overview

CVE-2026-13985 is a user interface (UI) spoofing vulnerability in the MediaCapture component of Google Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can serve a crafted HTML page that misrepresents the origin or state of media capture permissions. The flaw is classified under CWE-290 (Authentication Bypass by Spoofing) and CWE-451 (User Interface Misrepresentation of Critical Information). Google rated the Chromium security severity as Medium.

Critical Impact
Attackers who control a compromised renderer can spoof Chrome UI elements to trick users into granting or misidentifying microphone and camera capture sessions, undermining trust in browser security indicators.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based browsers embedding the vulnerable MediaCapture implementation
Downstream distributions that had not yet integrated the Stable Channel update

Discovery Timeline

2026-06-30 - CVE-2026-13985 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13985

Vulnerability Analysis

The vulnerability resides in Chrome's MediaCapture implementation, which mediates access to microphone, camera, and screen capture APIs. The component fails to correctly render or bind UI trust indicators when invoked from a renderer under attacker influence. As a result, prompts, permission chips, or in-use indicators can misrepresent the true origin requesting media access.

Exploitation requires two conditions. First, the attacker must have already compromised the Chrome renderer process, typically via a separate memory corruption or logic bug. Second, the victim must interact with the crafted HTML page, since the attack depends on user action on a spoofed UI element. Successful exploitation compromises integrity of the security UI without directly disclosing data or crashing the browser.

Root Cause

The root cause is an inappropriate implementation in how MediaCapture conveys origin and permission state to the browser process UI layer. Because a compromised renderer can influence attributes surfaced to the user, the browser trust boundary between renderer-supplied content and privileged UI chrome is not consistently enforced. This maps to [CWE-451], where security-relevant information is presented in a misleading way.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker first achieves renderer compromise, then navigates the compromised tab or a controlled frame to a crafted HTML page. The page manipulates getUserMedia or related MediaCapture flows so that the resulting Chrome UI misrepresents which origin is requesting or actively using capture devices. See the Chromium Issue Tracker #514013849 for implementation-level details.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-13985

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 after the patch release date
Unexpected getUserMedia prompts, permission grants, or active capture indicators tied to origins the user did not intentionally visit
Renderer process crashes or sandbox anomalies preceding suspicious media capture activity, suggesting chained renderer compromise

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 150.0.7871.47
Correlate browser telemetry with endpoint process events to identify renderer children spawning unusual media capture sessions
Review web proxy logs for navigation to low-reputation domains immediately followed by microphone or camera device activation

Monitoring Recommendations

Enable enterprise reporting via Chrome Enterprise policies to capture extension activity and version state
Alert on endpoint audio and video device access events initiated by browser processes outside of sanctioned conferencing domains
Track Chrome Stable Channel release advisories and cross-reference against endpoint version inventories on a recurring cadence

How to Mitigate CVE-2026-13985

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after update to ensure the patched MediaCapture code path is active
Audit granted camera and microphone permissions in chrome://settings/content/camera and chrome://settings/content/microphone and revoke entries for unfamiliar origins

Patch Information

Google released the fix in the Chrome Stable Channel update 150.0.7871.47. Refer to the Google Chrome Stable Update advisory for the full release notes. Enterprises using managed Chrome deployments should push the update through Chrome Browser Cloud Management, group policy, or their configuration management tooling.

Workarounds

Restrict media capture site permissions using the VideoCaptureAllowedUrls and AudioCaptureAllowedUrls Chrome Enterprise policies to a known allowlist
Set DefaultAudioCaptureSetting and DefaultVideoCaptureSetting to block by default, requiring explicit administrator approval
Disable or scope untrusted browser extensions, since renderer compromise chains often originate from extension abuse or malicious web content

bash

# Configuration example: Chrome Enterprise policy JSON to restrict media capture
{
  "DefaultAudioCaptureSetting": 2,
  "DefaultVideoCaptureSetting": 2,
  "AudioCaptureAllowedUrls": [
    "https://meet.google.com",
    "https://[*.]corp.example.com"
  ],
  "VideoCaptureAllowedUrls": [
    "https://meet.google.com",
    "https://[*.]corp.example.com"
  ]
}