CVE-2026-13995: Google Chrome Autofill XSS Vulnerability

CVE-2026-13995 Overview

CVE-2026-13995 is a user interface (UI) spoofing vulnerability in the Autofill component of Google Chrome on Android. Versions prior to 150.0.7871.47 fail to properly validate untrusted input rendered through Autofill prompts. A remote attacker can craft a malicious HTML page that manipulates Autofill UI elements to mislead the user. Successful exploitation requires user interaction, such as visiting an attacker-controlled site and engaging with the spoofed prompt. The flaw is tracked under CWE-20: Improper Input Validation and rated Medium severity by the Chromium project.

Critical Impact
Attackers can spoof Chrome Autofill UI on Android to deceive users into disclosing sensitive information such as credentials, payment data, or addresses stored in the browser.

Affected Products

Google Chrome for Android prior to version 150.0.7871.47
Chromium-based browsers on Android sharing the affected Autofill code path
Downstream Android WebView-derived surfaces relying on the vulnerable Autofill logic

Discovery Timeline

2026-06-30 - CVE-2026-13995 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13995

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem on Android. Autofill on mobile presents suggestion surfaces (such as saved passwords, payment cards, and addresses) directly overlaid on web content. Because Chrome does not sufficiently validate untrusted input supplied by the rendering page, an attacker-controlled HTML document can influence what the Autofill UI displays or where it is positioned.

The practical consequence is UI spoofing. An attacker can present visual elements that appear to originate from Chrome's trusted browser chrome or from a legitimate site, while actually driving user interaction into an attacker-controlled context. This class of flaw undermines the trust boundary between web content and browser-rendered UI.

The issue is documented in the Chromium Issue Tracker and referenced in the Chrome Releases blog.

Root Cause

The root cause is improper input validation (CWE-20) in the Autofill component. Untrusted values from a page influence the rendering of Autofill prompts without sufficient sanitization or boundary enforcement between page content and browser UI.

Attack Vector

The attack is remote over the network and requires user interaction. A user must load a crafted HTML page in an affected Chrome for Android build and engage with the manipulated Autofill prompt. No privileges are required, and the attack complexity is low. The vulnerability affects integrity of information the user sees, but does not directly grant code execution or expose confidentiality without user action on the spoofed UI.

The vulnerability is described in prose rather than code because no verified proof-of-concept is publicly available. Refer to the Chromium Issue Tracker entry once it is opened to the public for further technical detail.

Detection Methods for CVE-2026-13995

Indicators of Compromise

Android devices running Chrome versions earlier than 150.0.7871.47 browsing untrusted or newly registered domains that trigger Autofill prompts.
User reports of Autofill suggestion popups appearing on pages with unusual form fields or off-origin overlays.
Web traffic to domains hosting HTML pages that programmatically focus form fields to invoke Autofill immediately after load.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag devices below 150.0.7871.47.
Correlate mobile browsing telemetry with threat intelligence feeds for phishing infrastructure that abuses Autofill-style overlays.
Review mobile endpoint management (MDM/UEM) compliance reports for Chrome update status.

Monitoring Recommendations

Monitor Google Play update deployment metrics to confirm Chrome patch propagation across the fleet.
Track user-reported phishing incidents involving credential, payment card, or address prompts inside Chrome on Android.
Ingest browser version telemetry into the SIEM to alert on out-of-date installations that remain exposed.

How to Mitigate CVE-2026-13995

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store.
Enforce mandatory Chrome updates via mobile device management (MDM) policies for enterprise-managed Android devices.
Communicate user guidance to be cautious of Autofill prompts on unfamiliar sites until updates are confirmed.

Patch Information

Google has released a fixed build of Chrome for Android at version 150.0.7871.47. Details are published in the Chrome Releases announcement. Users should verify the installed version under Chrome settings and confirm auto-updates are enabled in the Google Play Store.

Workarounds

Disable Chrome Autofill for passwords, payment methods, and addresses on Android until the patched version is installed.
Restrict browsing to trusted domains via enterprise web filtering while patch rollout completes.
Advise users to type sensitive information manually rather than accepting Autofill suggestions on unfamiliar sites.

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected patched output
# versionName=150.0.7871.47 (or later)