Is CVE-2026-13986 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13986 being exploited in the wild.

How severe is CVE-2026-13986?

Informational severity, with a CVSS score of 4.3, published 30 June 2026.

Which products and versions are affected?

Google ChromeOS prior to 150.0.7871.47.

Is there a fix for CVE-2026-13986?

A patch was published on 2026-06-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13986 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-13986?

Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13986: Google ChromeOS UI spoofing in Media UI

CVE-2026-13986 · Severity: info · CVSS 4.3 · Published 2026-06-30

A vulnerability in the Media user interface of Google Chrome on ChromeOS could allow a malicious website to trick users. By convincing a user to perform specific interactions, an attacker can spoof parts of the browser's interface. This could be used to mislead users about the source or nature of media content they are viewing, potentially leading to further social engineering attacks.

Technologies: Google ChromeOS. Vendors: Google.

Quick answers

Is CVE-2026-13986 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13986 being exploited in the wild.
How severe is CVE-2026-13986?: Informational severity, with a CVSS score of 4.3, published 30 June 2026.
Which products and versions are affected?: Google ChromeOS prior to 150.0.7871.47.
Is there a fix for CVE-2026-13986?: A patch was published on 2026-06-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13986 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-13986?: Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A UI spoofing vulnerability exists in the Media UI component of Google Chrome on ChromeOS prior to version 150.0.7871.47. The flaw stems from an inappropriate implementation that fails to properly isolate or validate UI elements during specific user gestures. A remote attacker can exploit this by hosting a specially crafted HTML page and tricking a user into performing specific UI interactions. Successful exploitation allows the attacker to misrepresent interface elements, which can be leveraged for phishing or social engineering. The issue is addressed in ChromeOS version 150.0.7871.47.

Affected products

Google ChromeOS prior to 150.0.7871.47

Timeline

2026-06-30: disclosed
2026-06-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.