What is the CVSS score of CVE-2026-13895?

CVE-2026-13895 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13895?

Yes, a patch is available for CVE-2026-13895. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13895

EUVD-2026-40581 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-qhpw-xfcg-74cw

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

Network delivery requires no privileges, but high complexity and mandatory UI gestures limit exploitability; UI spoofing yields only limited integrity impact with no confidentiality loss.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:26 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via Chrome's Autofill component affects all desktop installations prior to version 150.0.7871.47, enabling a remote attacker to misrepresent interface elements through a crafted HTML page. Exploitation requires both navigating to an attacker-controlled page and performing specific UI gestures, reflected in CVSS AC:H and UI:R - passive browsing is insufficient. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.2 Medium score reflects limited integrity and availability impact with no confidentiality loss.

Technical ContextAI

The vulnerability resides in Chrome's Autofill subsystem, which parses and renders HTML form elements to surface saved credential or data suggestions. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as a failure to appropriately constrain how crafted HTML can influence the Autofill UI rendering pipeline - allowing attacker-supplied markup to alter or spoof the visual representation of interface elements. Because Autofill operates at the browser UI layer rather than within a sandboxed renderer context, such misrepresentation can appear authoritative to the user. Affected versions are all Chrome desktop stable channel builds below 150.0.7871.47, as confirmed by both the Chrome Releases advisory and EUVD-2026-40581.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later using Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise deployment tooling. The vendor-released patch is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control prior to patching, disabling Autofill entirely (Settings > Autofill and passwords > disable saved passwords and payment methods) removes the affected attack surface at the cost of user convenience. Restricting navigation to untrusted external sites via browser policy (e.g., enterprise URL allowlisting) reduces exposure but does not eliminate risk from compromised trusted sites. No additional vendor-documented workarounds are available in the referenced advisories.