CVE-2026-13999 is a vulnerability in Google Chrome's extension handling where insufficient validation of untrusted input allows a malicious extension to spoof the user interface. This can mislead users by displaying deceptive UI elements. The vulnerability affects Chrome versions before 150.0.7871.47. The CVSS v3.1 base score is 4.3 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No known exploits are reported in the wild. The vendor advisory linked does not explicitly state a patch or remediation level, so patch status is not yet confirmed.

The vulnerability allows an attacker to perform UI spoofing by exploiting insufficient input validation in Chrome extensions. This could lead users to be deceived by malicious UI elements, potentially facilitating further social engineering attacks. There is no direct impact on confidentiality or availability, and the integrity impact is limited to UI spoofing. No known active exploitation has been reported.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should avoid installing untrusted or suspicious extensions to reduce risk. Follow updates from Google Chrome for official fixes.