CVE-2026-13989: Google Chrome XSS Vulnerability

CVE-2026-13989 Overview

CVE-2026-13989 is a user interface spoofing vulnerability in the PageInfo component of Google Chrome. The flaw affects versions prior to 150.0.7871.47 and stems from an inappropriate implementation classified under CWE-451, which covers user interface misrepresentation of critical information. A remote attacker who has already compromised the renderer process can serve a crafted HTML page to manipulate the browser's PageInfo UI. The manipulation misleads users about the security or origin properties of a page, enabling phishing and trust-abuse scenarios. Google classifies the Chromium security severity as Medium.

Critical Impact
An attacker with a compromised renderer process can spoof security-relevant browser UI to deceive users into trusting malicious content.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers sharing the affected PageInfo implementation
Desktop Chrome Stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-13989 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13989

Vulnerability Analysis

The vulnerability resides in Chrome's PageInfo surface, the UI element that displays site identity, connection security, and permission state when a user inspects a page. An inappropriate implementation permits content controlled by a compromised renderer to influence what the PageInfo UI presents to the user. Because PageInfo is a primary trust indicator in the browser, tampering with its output undermines the user's ability to distinguish legitimate sites from attacker-controlled content.

Exploitation is not straightforward. The attacker must first achieve code execution or comparable control inside the renderer process, and the attack requires user interaction with the crafted page. The vulnerability does not directly expose confidential data or crash the browser, but it enables convincing spoofing that supports downstream credential theft or malware delivery.

Root Cause

The root cause is an implementation defect in how PageInfo constructs or renders elements based on state that can be influenced from a compromised renderer. Under [CWE-451], the UI fails to correctly represent security-critical information, allowing a mismatch between what the user sees and the true state of the page.

Attack Vector

The attack path is network-based and chained. An attacker first compromises the renderer through a separate flaw or a malicious extension context. The attacker then loads a crafted HTML page that triggers the inappropriate PageInfo behavior. When the user opens the PageInfo panel, the spoofed content is presented, encouraging the user to trust the page or grant permissions.

No verified public proof-of-concept code exists for this issue. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13989

Indicators of Compromise

Chrome processes running versions earlier than 150.0.7871.47 after the patch release date
Renderer processes exhibiting anomalous child process creation or memory patterns consistent with prior renderer compromise
Browser telemetry showing unexpected navigation to attacker-controlled HTML followed by permission grants or credential submissions

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 150.0.7871.47
Correlate renderer sandbox escape indicators with subsequent user interaction events on suspicious domains
Hunt for phishing landing pages that trigger PageInfo interactions, focusing on domains newly registered or lacking reputation

Monitoring Recommendations

Enable enterprise browser reporting to collect version, extension, and navigation telemetry centrally
Monitor DNS and proxy logs for connections to low-reputation domains hosting crafted HTML content
Track user reports of mismatched site identity indicators as potential exploitation signals

How to Mitigate CVE-2026-13989

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Restart Chrome after deploying the update to ensure the patched binaries are loaded
Audit installed browser extensions and remove any that are unnecessary or untrusted, as extensions can influence renderer behavior

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update. Administrators should validate the deployed build reports version 150.0.7871.47 or higher and confirm the update pushed to all channels used in the environment.

Workarounds

Enforce automatic Chrome updates through enterprise policy to eliminate manual patching gaps
Restrict the installation of untrusted extensions using Chrome Enterprise policies to reduce the risk of renderer compromise
Deliver user awareness guidance on verifying site identity through multiple indicators rather than relying solely on the PageInfo panel

bash

# Enforce Chrome minimum version and auto-update via enterprise policy (Linux example)
# /etc/opt/chrome/policies/managed/chrome_update.json
{
  "TargetVersionPrefix": "150.0.7871.",
  "DefaultBrowserSettingEnabled": true,
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved-extension-id>"]
}