What is the CVSS score of CVE-2026-13857?

CVE-2026-13857 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13857?

Yes, a patch is available for CVE-2026-13857. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13857

EUVD-2026-40543 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-7r6x-m6fv-hqg2

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network-delivered via crafted page (AV:N), specific UI gesture conditions required (AC:H), no attacker privileges needed (PR:N), mandatory user interaction (UI:R), UI spoofing yields limited integrity and availability impact with no confidentiality exposure.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:24 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via crafted HTML in Google Chrome's Geometry component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent security-critical interface elements to users who are socially engineered into performing specific UI gestures. The flaw stems from an inappropriate implementation in Chrome's Geometry subsystem (CWE-451), affecting the integrity and availability of the browser interface at low impact levels. No public exploit or active exploitation has been identified; Google has released a confirmed patch in version 150.0.7871.47.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's Geometry subsystem - responsible for spatial layout and positioning calculations within the browser's rendering pipeline - incorrectly processes or interprets certain geometric data when handling crafted HTML pages. This allows an attacker-controlled page to manipulate how UI elements are visually presented to the user, potentially spoofing address bars, permission prompts, or other security-sensitive browser chrome. The vulnerability exists in the Chromium rendering engine underpinning Google Chrome prior to version 150.0.7871.47, as confirmed by the EUVD affected version range and the Google Chrome Releases advisory.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should deliver this patch automatically on most desktop configurations; administrators managing enterprise fleets should verify deployment via Google Update or equivalent MDM tooling. As a compensating control where immediate patching is not feasible, organizations can reduce exposure by restricting user navigation to untrusted external sites and deploying browser isolation solutions, though these carry operational overhead and do not constitute a fix. No workarounds that fully mitigate the Geometry misimplementation are documented in available references.