CVE-2026-13999
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile — higher than 7% of all known CVEs
Summary
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension.
Risk Assessment
The risk involves tricking users with a spoofed browser interface, potentially leading to data theft or unauthorized actions within a trusted website context.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, and educate users to install only trusted extensions.
Original NVD description (English source)
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)