What is the CVSS score of CVE-2026-13913?

CVE-2026-13913 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13913?

Yes, a patch is available for CVE-2026-13913. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-13913

EUVD-2026-40599 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-52gf-2x69-m2w4

Information Disclosure Google Apple Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth needed but requires active user UI gestures; only confidentiality is impacted as Autofill data is read cross-origin without write or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:43 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.

Technical ContextAI

CWE-346 (Origin Validation Error) describes failures to verify that a resource or operation belongs to the expected origin, thereby breaking same-origin policy guarantees. Chrome's Autofill subsystem on iOS interacts with the iOS platform layer and WebKit rendering engine; insufficient origin checks in this interaction allow a cross-origin page to observe or extract data that the browser's security model should isolate. The iOS-specific scope suggests the flaw may arise from a platform-level Autofill API integration or gesture-handling pathway that differs from Chrome's desktop builds. Affected product per EUVD-2026-40599: Google Chrome on iOS below version 150.0.7871.47. No CPE strings were provided in the source data, so platform scoping is derived from the CVE description.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the App Store update mechanism or Chrome's in-app update prompt. The vendor-released patch is confirmed by the Chrome Releases stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and EUVD-2026-40599. No documented workarounds are available from the vendor. As a compensating control, organizations managing iOS devices via MDM can restrict Chrome access to untrusted or external websites, reducing exposure to attacker-controlled pages - this trades browsing flexibility for reduced attack surface. Users may also disable Chrome's Autofill feature (Settings > Autofill and Payments > toggle off) to eliminate the vulnerable subsystem entirely, at the cost of losing automatic form-fill convenience. Prompt patching remains the definitive remediation.