What is the CVSS score of CVE-2026-13917?

CVE-2026-13917 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13917?

Yes, a patch is available for CVE-2026-13917. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13917

EUVD-2026-40603 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-568p-3frm-j63m

Authentication Bypass Apple Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N), no privileges needed (PR:N), but specific user gestures are mandatory (UI:R); only integrity is impacted through navigation bypass.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:26 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page with gesture-triggered navigation payload

Delivery

Deliver link to target Chrome for iOS user via phishing or malvertising

Exploit

Victim opens page in Chrome on iOS device

Execution

Attacker-controlled page prompts victim into specific UI gestures

Persist

Insufficient input validation triggered in Chrome iOS navigation layer

Impact

Browser navigation restrictions bypassed, victim redirected or navigation context spoofed

Access

Craft malicious HTML page with gesture-triggered navigation payload

Delivery

Deliver link to target Chrome for iOS user via phishing or malvertising

Exploit

Victim opens page in Chrome on iOS device

Execution

Attacker-controlled page prompts victim into specific UI gestures

Persist

Insufficient input validation triggered in Chrome iOS navigation layer

Impact

Browser navigation restrictions bypassed, victim redirected or navigation context spoofed

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Google Chrome on an iOS device with a version prior to 150.0.7871.47 - not Safari or any other browser. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a moderate-to-significant integrity impact with no confidentiality or availability consequences, requiring no privileges but mandating user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page designed to prompt or trick the victim into performing specific touch gestures - such as swipes or taps that appear to be part of normal page interaction. When a Chrome for iOS user visits the page and executes the targeted gestures, the insufficient input validation allows the page to bypass Chrome's navigation restrictions, potentially redirecting the browser to an attacker-controlled URL or spoofing navigation context. …
Remediation	Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.