CVE-2026-13995 is a vulnerability in Google Chrome on Android where insufficient validation of untrusted input in the Autofill component allows remote attackers to conduct UI spoofing attacks by crafting malicious HTML pages. This vulnerability affects versions prior to 150.0.7871.47. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no explicit vendor advisory stating the patch status, but the affected version indicates that 150.0.7871.47 is the fixed version.

The vulnerability enables remote attackers to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. This can lead to user confusion or tricking users into unintended actions. There is no direct impact on confidentiality or availability, but the integrity of the user interface can be compromised.

Users should update Google Chrome on Android to version 150.0.7871.47 or later to remediate this vulnerability. Since the affected version is prior to 150.0.7871.47, applying this update addresses the issue. No additional vendor advisory details about temporary fixes or mitigations are provided.