What is the CVSS score of CVE-2026-13847?

CVE-2026-13847 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13847?

Yes, a patch is available for CVE-2026-13847. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13847

EUVD-2026-40533 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-3h78-8h5p-xvvw

Information Disclosure Google Apple Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered crafted page requires only victim interaction (UI:R); cross-origin leak yields high confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:57 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.

Technical ContextAI

Chrome for iOS operates under Apple's App Store requirements and uses WebKit as its underlying rendering engine rather than the Blink engine used by Chrome on other platforms, introducing platform-specific input-handling code paths. CWE-20 (Improper Input Validation) identifies the root cause: attacker-controlled input originating from an untrusted cross-origin context is not sufficiently validated before being processed, allowing the crafted page to bypass the browser's Same-Origin Policy enforcement. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions across platforms, though the description and EUVD data scope the actual impact to the iOS platform variant exclusively. The vulnerability was reported by chrome-cve-admin@google.com and tracked in Chromium issue 517073397.

RemediationAI

Update Google Chrome for iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If the update cannot be applied immediately, organizations should instruct iOS users to avoid browsing to untrusted or unfamiliar websites using Chrome on iOS until the patch is deployed; this reduces exposure but does not eliminate it, as the crafted page can be served from any attacker-controlled domain. Enabling platform-level content filtering or mobile threat defense on managed iOS devices provides partial compensating control but introduces latency and may block legitimate content. Switching to Safari on iOS as a temporary measure entirely sidesteps the vulnerable Chrome iOS code path, though this carries usability trade-offs for users reliant on Chrome-specific features or enterprise MDM policies.