This vulnerability (CVE-2026-13948) affects Google Chrome versions before 150.0.7871.47 and is caused by insufficient policy enforcement in extensions. An attacker can exploit this by tricking a user into installing a malicious extension, which can then perform UI spoofing attacks. The CVSS 3.1 vector indicates the attack requires user interaction and has a low impact on integrity without affecting confidentiality or availability. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm patch status, but the affected version suggests the issue is fixed in 150.0.7871.47.

The impact is limited to low integrity loss through UI spoofing, which could mislead users but does not compromise confidentiality or availability. The attack requires user interaction (installing a malicious extension) and has a high attack complexity. No known active exploitation has been reported.

The vulnerability is addressed in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to mitigate the risk. Since the vendor advisory does not explicitly state the patch status, it is recommended to verify the update availability via the official Chrome release notes. No additional mitigation steps are indicated.