CVE-2026-13948
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension.
Risk Assessment
The risk involves the ability to spoof trusted browser interface elements, potentially leading to data theft or tricking users into performing dangerous actions.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, and educate users to install only trusted extensions.
Original NVD description (English source)
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)