What is the CVSS score of CVE-2026-13842?

CVE-2026-13842 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13842?

Yes, a patch is available for CVE-2026-13842. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13842

EUVD-2026-40528 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-76xp-9pf8-pqhv

Information Disclosure Apple Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring user to visit the page (UI:R); only the address bar display is affected (I:L), with no confidentiality or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:38 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft spoofing HTML page

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

Victim opens page in Chrome for iOS

Execution

Omnibox displays attacker-chosen URL

Persist

Victim submits credentials to fake form

Impact

Attacker harvests credentials

Access

Craft spoofing HTML page

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

Victim opens page in Chrome for iOS

Execution

Omnibox displays attacker-chosen URL

Persist

Victim submits credentials to fake form

Impact

Attacker harvests credentials

Vulnerability AssessmentAI

Exploitation	The victim must open a crafted HTML page in Google Chrome on an iOS device running a Chrome version below 150.0.7871.47 - user interaction is required (UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields a base score of 4.3, reflecting network delivery with no privilege requirement but mandatory user interaction and limited integrity impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a phishing link to an iOS Chrome user - via email, SMS, or social media - pointing to a crafted HTML page hosted on an attacker-controlled domain. When the victim opens the link in Chrome for iOS, the page's JavaScript or HTML manipulates the Omnibox to display a trusted URL such as 'https://mybank.example.com' while the actual document continues to execute attacker-controlled content, enabling credential harvesting via a fake login form. …
Remediation	Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome release advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and EUVD-2026-40528. … Detailed patch versions, workarounds, and compensating controls in full report.