What is the CVSS score of CVE-2026-13942?

CVE-2026-13942 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13942?

Yes, a patch is available for CVE-2026-13942. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13942

EUVD-2026-40630 LOW

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-jjj3-5mqc-gwqv

Information Disclosure Google

3.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local-only delivery of crafted HTML, user must open page (UI:R), no data exfiltrated (C:N), integrity-only UI spoofing (I:L), no privilege needed to craft or serve the page (PR:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 22:31 vuln.today

CVSS changed

Jul 01, 2026 - 20:22 NVD

3.3 (LOW)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Video Capture component on ChromeOS allows a local attacker to deceive users by rendering misleading interface elements through a specially crafted HTML page. Versions prior to 150.0.7871.47 on ChromeOS are affected. No public exploit code exists and no active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC rates exploitation as none - making this a low operational priority despite the low-complexity attack conditions.

Technical ContextAI

The flaw is classified as CWE-20 (Improper Input Validation), which Chrome's security team categorizes under its 'Inappropriate implementation' label - meaning the Video Capture subsystem does not sufficiently validate or constrain HTML-driven input in a way that permits spoofed UI rendering. The Video Capture API in Chromium interacts with ChromeOS-specific hardware and permission layers; a crafted HTML page can apparently influence how capture-related UI elements (e.g., permission dialogs, stream indicators) are presented to the user. The attack is confined to ChromeOS because the Video Capture integration is implemented differently on that platform than on other Chrome OS targets. Affected CPE per EUVD: Google Chrome on ChromeOS prior to version 150.0.7871.47.

RemediationAI

Update Google Chrome on ChromeOS to version 150.0.7871.47 or later, which contains the vendor-released patch for this issue. ChromeOS devices with automatic updates enabled will receive this fix through the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations managing ChromeOS fleets via Google Admin Console should verify that the stable channel update has propagated to all managed devices. No public workarounds are documented; given the low severity and the availability of a vendor patch, compensating controls are not necessary for most environments. Forcing Chrome updates via policy is the complete and recommended remediation.