CVE-2026-13999: Google Chrome UI Spoofing Vulnerability

CVE-2026-13999 Overview

CVE-2026-13999 is an input validation vulnerability [CWE-20] in the Extensions component of Google Chrome versions prior to 150.0.7871.47. The flaw allows an attacker who convinces a user to install a malicious extension to perform user interface (UI) spoofing through a crafted Chrome Extension. Google classifies the Chromium security severity as Medium. Exploitation requires user interaction to install the malicious extension, and the impact is limited to integrity of what the user sees in the browser UI.

Critical Impact
A crafted Chrome Extension can spoof browser UI elements, enabling phishing, credential capture, and deception of users interacting with what appears to be legitimate Chrome interface components.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.47
Chromium-based browsers that inherit the vulnerable Extensions component
Any environment permitting installation of untrusted Chrome Extensions

Discovery Timeline

2026-06-30 - CVE-2026-13999 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13999

Vulnerability Analysis

The vulnerability resides in how the Chrome Extensions subsystem validates untrusted input supplied through extension APIs. A malicious extension can leverage insufficient validation to render or manipulate UI elements in a way that spoofs trusted Chrome interface components. Because Chrome extensions operate with elevated privileges relative to standard web content, they can influence browser chrome and page overlays in ways ordinary web pages cannot.

UI spoofing attacks in this class typically enable convincing phishing prompts, fake permission dialogs, forged address bar content, or overlays that impersonate secure browser indicators. The vulnerability itself does not permit code execution or data exfiltration directly, but it lowers the barrier for downstream social engineering and credential theft.

Root Cause

The root cause is classified as [CWE-20] Improper Input Validation. The Extensions component accepts input from extension code without sufficient sanitization or constraint checking before that input influences UI rendering. Google addressed the issue in Chrome 150.0.7871.47 by tightening validation on the affected extension API surface. Refer to the Chromium Issue Tracker Entry for the internal report.

Attack Vector

An attacker must first convince a user to install a malicious Chrome extension, typically through the Chrome Web Store, sideloading, or enterprise policy abuse. Once installed, the extension issues crafted input to the vulnerable API to render spoofed UI. The attack requires user interaction and does not require authentication or elevated privileges beyond standard extension permissions.

No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low likelihood of exploitation activity at this time.

Detection Methods for CVE-2026-13999

Indicators of Compromise

Chrome browser instances running versions prior to 150.0.7871.47 with unmanaged or unknown extensions installed
Unexpected extension installations originating from outside the Chrome Web Store or approved enterprise policy
User reports of duplicated or unusual permission prompts, address bar anomalies, or overlay dialogs
Extensions requesting broad host permissions or activeTab scopes without clear business justification

Detection Strategies

Inventory installed Chrome extensions across the fleet and correlate against an allowlist of approved extension IDs
Query endpoint telemetry for the chrome.exe version string to identify hosts still running vulnerable builds
Review Chrome enterprise reporting for ExtensionInstallEvent entries and flag installations from unmanaged sources

Monitoring Recommendations

Enable Chrome Enterprise cloud reporting to stream extension inventory and browser version data into a central log platform
Alert on installation of any extension outside the corporate allowlist or with <all_urls> host permissions
Track user reports of suspicious browser prompts and correlate with recent extension changes on the same host

How to Mitigate CVE-2026-13999

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Audit installed extensions and remove any not required for business use
Restrict extension installation to an administrator-defined allowlist using Chrome Enterprise policy
Educate users on the risks of installing extensions from untrusted sources

Patch Information

Google released the fix in the Stable channel update covered by the Google Chrome Desktop Update. Upgrading Chrome to 150.0.7871.47 or later remediates the vulnerability. Chromium-derived browsers should apply the corresponding upstream patch when their vendors publish updated builds.

Workarounds

Deploy the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to prevent installation of unapproved extensions
Set ExtensionInstallSources to restrict installation origins to the Chrome Web Store or vetted internal locations
Force browser updates through ChromeCleanupEnabled and auto-update policies until all endpoints reach the patched version

bash

# Configuration example: Chrome Enterprise policy to restrict extensions
# Windows registry path: HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist
ExtensionInstallBlocklist = ["*"]
ExtensionInstallAllowlist = [
  "approved_extension_id_1",
  "approved_extension_id_2"
]
ExtensionInstallSources = ["https://chrome.google.com/webstore/*"]