What is the CVSS score of CVE-2026-13867?

CVE-2026-13867 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13867?

Yes, a patch is available for CVE-2026-13867. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13867

EUVD-2026-40553 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-4742-633w-44xh

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted web page; user must interact with spoofed dialog; UI deception yields only low integrity impact with no code execution, data theft, or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:39 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.

Technical ContextAI

CWE-451 (UI Misrepresentation of Critical Information) describes flaws where critical security information is presented in a misleading or deceptive way. Chrome's Geolocation API implementation exposes permission prompt dialogs tied to the requesting origin; the inappropriate implementation in versions below 150.0.7871.47 allows a crafted HTML page to manipulate how this dialog is rendered or attributed - potentially masking the true requesting origin. This is a browser-engine logic flaw in Chromium's Geolocation subsystem, not a memory safety or remote code execution class issue. The EUVD-2026-40553 entry corroborates the affected version range as all Chrome desktop releases below 150.0.7871.47.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, which resolves this vulnerability per the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; users can manually trigger the update via Settings > Help > About Google Chrome and restarting the browser. As a compensating control for environments that cannot immediately update, administrators may disable geolocation access site-wide via enterprise policy (ContentSettingsGeolocationAllowedForUrls or block-all policy), though this will break legitimate geolocation-dependent web applications and is not recommended as a permanent measure. No other effective workaround exists for this UI-layer flaw.