CVE-2026-13939 is a vulnerability in Google Chrome on Android affecting versions before 150.0.7871.47. It involves insufficient validation of untrusted input within the WebShare component, which can be exploited by a remote attacker with control over the renderer process to conduct UI spoofing attacks using crafted HTML content. This vulnerability does not impact confidentiality or availability but has a limited impact on integrity. The CVSS base score is 3.1, reflecting low severity. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The vulnerability allows an attacker who has already compromised the renderer process to perform UI spoofing, potentially misleading users by displaying deceptive interface elements. There is no direct impact on confidentiality or availability. The overall impact is limited to integrity with low severity.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed patched. Until then, no specific mitigations are provided by the vendor advisory.