CVE-2026-13994: Google Chrome Auth Bypass Vulnerability

CVE-2026-13994 Overview

CVE-2026-13994 is a user interface (UI) spoofing vulnerability in the Credential Management component of Google Chrome on Android. Versions prior to 150.0.7871.47 contain an inappropriate implementation that allows a remote attacker to spoof security-relevant UI elements through a crafted HTML page. Google Chromium rates the security severity as Medium. The weakness is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Exploitation requires user interaction with the malicious page but does not require prior authentication.

Critical Impact
A remote attacker can spoof credential management UI on Chrome for Android, potentially tricking users into disclosing account credentials or approving unintended actions.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based browsers on Android incorporating the vulnerable Credential Management implementation
Mobile deployments relying on Chrome for authentication workflows

Discovery Timeline

2026-06-30 - CVE-2026-13994 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13994

Vulnerability Analysis

The vulnerability resides in the Credential Management API implementation within Chrome for Android. An inappropriate implementation permits attacker-controlled content to alter or overlay UI elements associated with credential prompts. This allows adversaries to present misleading information about the origin or intent of a credential request. Because the UI conveys trust decisions to the user, misrepresentation directly undermines the security guarantees of the credential flow.

The attack targets user perception rather than memory safety or logic in the browser sandbox. The impact is limited to integrity of the displayed content, with no direct confidentiality or availability loss. However, integrity failures at this layer can cascade into credential theft when users act on spoofed prompts.

Root Cause

The root cause is an incorrect implementation in how the Credential Management component renders or scopes security-relevant UI in Chrome for Android. The component does not sufficiently isolate trusted browser chrome from attacker-controlled HTML content, enabling misrepresentation of critical information as described in CWE-451.

Attack Vector

An attacker hosts a crafted HTML page and lures the victim to visit it in Chrome for Android. When the victim interacts with the page, the attacker manipulates the credential management UI to display misleading origin, identity, or action information. The victim may then approve credential release or authentication actions believing them to be legitimate.

No verified proof-of-concept code is publicly available for CVE-2026-13994. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Chrome Blog Update.

Detection Methods for CVE-2026-13994

Indicators of Compromise

Chrome for Android clients reporting a version earlier than 150.0.7871.47 in device inventory or user-agent telemetry
Web traffic to newly registered or low-reputation domains that host credential prompts styled to mimic known services
User reports of unexpected credential save, autofill, or WebAuthn prompts triggered by unrelated web content

Detection Strategies

Inventory browser versions across managed mobile fleets and flag Chrome for Android builds below 150.0.7871.47
Correlate DNS and proxy logs for access to phishing infrastructure paired with credential submission events
Use mobile threat defense telemetry to identify browsing sessions that render credential UI on untrusted origins

Monitoring Recommendations

Alert on outbound authentication requests originating from mobile browsers immediately after visits to uncategorized domains
Monitor identity provider logs for anomalous sign-in patterns from mobile devices, including impossible travel and new-device authentications
Track password manager and passkey usage events on Android to detect prompts served outside expected relying-party domains

How to Mitigate CVE-2026-13994

Immediate Actions Required

Update Chrome for Android to version 150.0.7871.47 or later through the Google Play Store
Push the updated Chrome build to managed Android devices using enterprise mobility management (EMM) policies
Communicate the risk of UI spoofing to end users and reinforce validation of credential prompt origins

Patch Information

Google addressed CVE-2026-13994 in Chrome for Android 150.0.7871.47. Refer to the Chrome Blog Update for release notes and the Chromium Issue Tracker Entry for the underlying fix. Deploy the patched version across all Android endpoints and verify installation through mobile device management (MDM) reporting.

Workarounds

Restrict Chrome for Android to browse only approved origins via managed configuration until patching is complete
Disable browser-based credential autofill on managed devices and require use of a hardened enterprise password manager
Enforce phishing-resistant authentication such as FIDO2 security keys or platform passkeys bound to verified relying parties

bash

# Configuration example: Android Enterprise managed configuration for Chrome
# Restrict credential autofill and enforce minimum version via MDM
{
  "PasswordManagerEnabled": { "value": false },
  "AutofillCreditCardEnabled": { "value": false },
  "URLBlocklist": { "value": ["*"] },
  "URLAllowlist": { "value": ["https://*.corp.example.com"] },
  "MinimumChromeVersion": { "value": "150.0.7871.47" }
}