The vulnerability CVE-2026-13989 affects Google Chrome versions before 150.0.7871.47. It stems from an inappropriate implementation in the PageInfo feature, which fails to enforce policies correctly. This flaw enables a remote attacker with control over the renderer process to conduct UI spoofing attacks by crafting malicious HTML content. The issue is categorized with medium severity by Chromium security. There is no explicit vendor advisory detail on patch availability or remediation level beyond the version indication and a vendor blog link.

A remote attacker who has already compromised the renderer process can exploit this vulnerability to perform UI spoofing. This may cause users to be deceived by falsified interface elements, potentially leading to further exploitation or user trust compromise. The impact is limited to UI spoofing and requires prior renderer compromise, reducing the overall severity.

The vulnerability is addressed in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the issue. No additional mitigation guidance or temporary fixes are provided by the vendor. Patch status is not explicitly confirmed in the advisory, but the affected version suggests the fix is included in 150.0.7871.47. Refer to the official Google Chrome stable channel update blog for confirmation and update instructions.