What is the CVSS score of CVE-2026-13941?

CVE-2026-13941 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13941?

Yes, a patch is available for CVE-2026-13941. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-13941

EUVD-2026-40629 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-6j83-h3rq-6jcv

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered UI spoofing requires only that the user visit a crafted page (UI:R); impact is limited to misleading UI display with no code execution, confidentiality, or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:48 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in SiteSettings in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as a flaw in how Chrome's SiteSettings component on Android renders origin or permission-related information to the user. SiteSettings on Android governs site-specific permission prompts and controls (e.g., camera, location, notifications). An inappropriate implementation in this subsystem allows a crafted HTML page to manipulate how these UI elements are presented, potentially spoofing the apparent origin of a permission request or making a malicious site appear to be a trusted one. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions on Android prior to 150.0.7871.47. The vulnerability is Android-platform-specific; desktop Chrome is not indicated as affected.

RemediationAI

Upgrade Google Chrome on Android to version 150.0.7871.47 or later. This is the vendor-released patch as confirmed by the Google Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should verify that Chrome auto-updates are enabled via the Google Play Store to ensure timely patching. No documented workarounds are available for this SiteSettings UI spoofing issue - the only effective mitigation is applying the patch, as the flaw is internal to the browser's permission UI rendering logic. Organizations managing Android fleets via MDM should verify Chrome version compliance and push the update if auto-update is not enforced.