What is the CVSS score of CVE-2026-13966?

CVE-2026-13966 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13966?

Yes, a patch is available for CVE-2026-13966. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13966

EUVD-2026-40654 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-35g4-5hf8-mp9c

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via any webpage (AV:N, AC:L, PR:N); victim must visit attacker page (UI:R); spoofing yields only low integrity impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:45 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in History in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where a UI component can be induced to display misleading information to the user. In this case, Chrome's History subsystem - the mechanism tracking and surfacing visited URLs - contains an 'inappropriate implementation' that can be triggered via a crafted HTML page. Chrome's renderer process can influence browser-side UI elements through controlled HTML/JavaScript interactions, and a flaw in how History entries are recorded or rendered allows an attacker to manipulate what the user perceives. The affected product is Google Chrome desktop (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) for all versions prior to 150.0.7871.47. Tags referencing SUSE indicate this vulnerability was also tracked through Linux distribution security channels.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which is the vendor-released patch confirmed by the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will apply this fix automatically for most enterprise and consumer deployments; organizations managing Chrome via policy should verify the version floor is set to 150.0.7871.47. No specific workaround is documented for this History-component flaw, but organizations with high user-deception risk may consider restricting access to untrusted external websites via proxy policy as a compensating control until patching is complete - note this has significant usability trade-offs. The CVSS-defined low severity and absence of active exploitation allow normal patch cycle scheduling rather than emergency remediation.