What is the CVSS score of CVE-2026-13892?

CVE-2026-13892 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13892?

Yes, a patch is available for CVE-2026-13892. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13892

EUVD-2026-40578 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-q7jp-jrxx-2jjj

Information Disclosure Google Apple Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page, no privileges needed, mandatory user gesture interaction (UI:R), confidentiality-only impact with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:31 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.

Technical ContextAI

CWE-451 covers scenarios where UI elements or browser behavior misrepresent critical security boundaries, enabling content from one origin to be read or inferred by another - violating the Same-Origin Policy. Chrome on iOS is architecturally distinct from desktop Chrome: Apple's App Store policies require all iOS browsers to use WebKit as the rendering engine, meaning Chrome for iOS wraps WebKit rather than shipping its own Blink/V8 stack. The 'inappropriate implementation' designation indicates a logic or UX flaw in Chrome's iOS-specific code layer - possibly in gesture handling, overlay rendering, or frame interaction - that can be exploited via crafted HTML to bridge cross-origin isolation boundaries. The affected version range is all Chrome for iOS releases below 150.0.7871.47, per the EUVD entry EUVD-2026-40578 and the Chromium release advisory.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the Chrome stable channel update advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Updates are distributed via the Apple App Store; users should ensure automatic app updates are enabled or manually trigger the update through the App Store. As an interim compensating control for environments where immediate update is not possible, restricting end-user access to untrusted or external websites via mobile device management (MDM) policy can reduce exposure, though this significantly limits browser utility. There are no configuration-level workarounds within Chrome for iOS that disable the affected UI gesture handling without patching.