CVE-2026-13955 is a vulnerability in Google Chrome's CustomTabs on Android versions before 150.0.7871.47. The vulnerability arises from insufficient validation of untrusted input, which can be exploited by a local attacker to conduct UI spoofing attacks using a malicious file. The CVSS score is 3.3 (low severity), with no impact on confidentiality or availability, only limited integrity impact. No known exploits are reported in the wild. The vendor advisory is available but does not explicitly state remediation status or patch availability.

The vulnerability allows a local attacker to perform UI spoofing, potentially misleading users by presenting deceptive user interface elements. There is no impact on confidentiality or availability, and the integrity impact is limited. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, avoid opening untrusted files locally in CustomTabs on affected versions.