What is the CVSS score of CVE-2026-13795?

CVE-2026-13795 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13795?

Yes, a patch is available for CVE-2026-13795. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13795

EUVD-2026-40481 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-7gfw-2mp7-38w5

Authentication Bypass Google Apple Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page with mandatory user interaction (UI:R); no privileges required; impact is integrity-only navigation bypass with no data disclosure or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 21:34 vuln.today

CVSS changed

Jul 01, 2026 - 19:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 nvd

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) permits a remote, unauthenticated attacker to circumvent client-side policy controls by delivering a crafted HTML page to a victim user. The flaw originates from insufficient policy enforcement (CWE-602), where navigation security logic enforced within the browser client can be subverted through malicious web content. No active exploitation has been identified - CISA KEV is not listed, SSVC confirms Exploitation: none, and the EPSS score of 0.22% (13th percentile) reflects minimal real-world exploitation activity at time of analysis.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) describes a class of vulnerability where security-critical decisions are enforced exclusively within the client - in this case, Google Chrome's iOS-platform browser engine - rather than being backed or validated server-side, enabling a crafted input to subvert those controls. Chrome for iOS operates under Apple's platform constraints and integrates with iOS-specific navigation APIs, which diverge meaningfully from Chrome's desktop or Android implementations; this platform-specific code path is likely the locus of the enforcement gap. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is broadly scoped in NVD, but the description and EUVD affected-version data (Chrome < 150.0.7871.47 on iOS) narrow the exposure to the iOS build. The impact is an integrity bypass of navigation restrictions - an attacker can direct or influence browser navigation in ways the policy was designed to prevent.

RemediationAI

Upgrade Google Chrome on iOS to version 150.0.7871.47 or later, which includes the vendor-released patch for this flaw; the fix is documented in the Google Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users on iOS can update through the App Store or enable automatic app updates to receive the patch without manual intervention. If immediate update is not feasible in managed environments, Mobile Device Management (MDM) policies (e.g., via Apple Business Manager or Jamf) can be used to enforce minimum Chrome version compliance or restrict browsing to approved URLs, reducing exposure to crafted attacker-controlled pages - though this does not eliminate the vulnerability and adds user friction. Given the UI:R requirement, user security awareness training to avoid clicking unsolicited links provides a supplementary, low-cost compensating control.