CVE-2026-13994 is a vulnerability in Google Chrome on Android affecting versions before 150.0.7871.47. The issue stems from an inappropriate implementation in the Credential Management API that enables a remote attacker to conduct UI spoofing attacks by delivering a crafted HTML page. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with no impact on confidentiality or availability but a potential integrity impact through UI deception. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The vulnerability allows remote attackers to perform UI spoofing, potentially misleading users into interacting with deceptive interface elements. There is no direct impact on data confidentiality or system availability. The integrity impact is limited to user interface deception, which could facilitate social engineering or phishing attempts.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 150.0.7871.47 or later once confirmed. Until then, exercise caution when interacting with untrusted web content that could exploit UI spoofing.