CVE-2026-13996: Google Chrome UI Spoofing Vulnerability

CVE-2026-13996 Overview

CVE-2026-13996 is a user interface (UI) spoofing vulnerability in the Permissions component of Google Chrome prior to version 150.0.7871.47. A remote attacker can exploit the flaw by serving a crafted HTML page that misrepresents the origin or intent of a permission prompt. The issue is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Google classifies the Chromium security severity as Medium.

Successful exploitation requires user interaction, but does not require authentication or elevated privileges. Attackers can leverage the flaw to trick users into granting sensitive browser permissions such as camera, microphone, geolocation, or notifications.

Critical Impact
Remote attackers can spoof permission dialogs through crafted HTML pages, deceiving users into approving privileged browser capabilities they did not intend to grant.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based browsers inheriting the vulnerable Permissions implementation
Any operating system running an affected Chrome build (Windows, macOS, Linux)

Discovery Timeline

2026-06-30 - CVE-2026-13996 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13996

Vulnerability Analysis

The vulnerability resides in the Permissions subsystem of Google Chrome, which governs how the browser presents and processes user consent prompts for capabilities such as camera, microphone, geolocation, clipboard, and notifications. An inappropriate implementation allows a crafted HTML page to manipulate how these prompts render, enabling UI spoofing.

UI spoofing vulnerabilities defeat the trust boundary that permission dialogs are designed to enforce. Users rely on visual cues, origin indicators, and prompt placement to make informed decisions. When those cues can be manipulated by page content, attackers can convince users to grant capabilities to an origin different from the one displayed, or to approve a prompt they believe belongs to a different action.

The attack requires user interaction, meaning a victim must visit the malicious page and interact with the spoofed element. No authentication or prior privileges are required, and the flaw is exploitable over the network.

Root Cause

The root cause is classified as CWE-451, a misrepresentation of security-relevant information in the user interface. The Permissions component fails to enforce visual or logical integrity guarantees that would prevent page-controlled content from overlaying, mimicking, or altering the appearance of a legitimate permission prompt.

Attack Vector

Exploitation begins when a victim loads a crafted HTML page controlled by the attacker. The page constructs DOM elements, CSS styling, or timing conditions that cause the permission prompt to be misrepresented. The attacker then induces the user to click or otherwise interact with the prompt under false pretenses.

Because Chrome permissions persist per origin, a single successful spoof can result in long-lived access to sensitive device capabilities from an attacker-controlled site.

No verified proof-of-concept code has been published. Technical detail is tracked in the Chromium Issue Tracker Entry and the Google Chrome Desktop Update release notes.

Detection Methods for CVE-2026-13996

Indicators of Compromise

Chrome browser versions reporting a User-Agent string earlier than 150.0.7871.47 in enterprise telemetry
Unexpected permission grants (camera, microphone, geolocation, notifications) to unfamiliar origins in chrome://settings/content
Outbound connections from browser processes to newly registered or low-reputation domains immediately after user navigation

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build older than 150.0.7871.47
Correlate browsing telemetry with URL reputation feeds to identify visits to pages hosting suspicious permission-request patterns
Review the Chrome Preferences file per user profile for anomalous entries under profile.content_settings.exceptions covering media, geolocation, or notifications

Monitoring Recommendations

Ingest browser and endpoint logs into a centralized data lake to correlate version data with navigation and permission events
Alert on Chrome processes accessing device capabilities (camera, microphone, location services) immediately following interaction with newly visited domains
Track enterprise policy compliance for Chrome auto-update to ensure managed fleets converge on the patched build

How to Mitigate CVE-2026-13996

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Force a browser relaunch after update deployment to ensure the patched binary is active
Audit existing per-origin permission grants and revoke any that cannot be justified

Patch Information

Google released the fix in the Stable Channel update announced in the Google Chrome Desktop Update. Administrators should confirm the deployed build is 150.0.7871.47 or later. Chromium-derived browsers should pick up the corresponding upstream fix; verify with each vendor's advisory.

Workarounds

Deploy the Chrome enterprise policy DefaultGeolocationSetting, AudioCaptureAllowed, and VideoCaptureAllowed set to block by default until patching completes
Restrict permission prompts to explicitly allowlisted origins via AudioCaptureAllowedUrls and VideoCaptureAllowedUrls
Educate users to reject permission prompts that appear unexpectedly and to verify the origin displayed in the address bar before approving

bash

# Example Chrome enterprise policy (Linux managed_policies JSON)
{
  "DefaultGeolocationSetting": 2,
  "AudioCaptureAllowed": false,
  "VideoCaptureAllowed": false,
  "DefaultNotificationsSetting": 2,
  "AudioCaptureAllowedUrls": ["https://meet.example.com"],
  "VideoCaptureAllowedUrls": ["https://meet.example.com"]
}