CVE-2026-13867 is a vulnerability in the Geolocation feature of Google Chrome before version 150.0.7871.47. The issue arises from an inappropriate implementation that enables remote attackers to conduct UI spoofing by crafting malicious HTML pages. The vulnerability is classified under CWE-451 (Incorrect Expression of UI Element). The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. The vendor advisory URL points to a stable channel update that includes the fix, although explicit patch details are not provided in the input.

The vulnerability allows remote attackers to perform UI spoofing, which can deceive users into interacting with misleading or fraudulent interface elements. This could potentially lead to user confusion or trick users into unintended actions. There is no direct impact on confidentiality or availability. No known exploits in the wild have been reported.

Users and administrators should update Google Chrome to version 150.0.7871.47 or later to remediate this vulnerability. The vendor advisory indicates that this version contains the fix. Since this is a client-side browser vulnerability, applying the update is the primary mitigation. No additional vendor-provided temporary fixes or workarounds are noted.