This vulnerability (CVE-2026-13996) affects Google Chrome versions before 150.0.7871.47. The issue is an inappropriate implementation in the Permissions UI, which enables a remote attacker to conduct UI spoofing by crafting a malicious HTML page. The CVSS 3.1 base score is 6.5 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The vulnerability allows remote attackers to spoof the browser's permission UI, potentially misleading users into granting permissions or performing actions they would otherwise avoid. There is no direct confidentiality or availability impact, but the integrity of user decisions can be compromised. This could facilitate further attacks relying on user trust.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor for official updates from Google Chrome and apply them promptly once available. Until then, caution is advised when interacting with untrusted web content requesting permissions.