What is the CVSS score of CVE-2026-13972?

CVE-2026-13972 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13972?

Yes, a patch is available for CVE-2026-13972. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13972

EUVD-2026-40660 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-535v-mq2p-6m4m

Information Disclosure Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Delivered via network over HTTP/HTTPS with no privilege required, but mandatory user navigation (UI:R); impact is limited to integrity via visual deception with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 04:31 vuln.today

CVSS changed

Jul 02, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker server

Delivery

Deliver link to victim via phishing or ad network

Exploit

Victim opens page in unpatched Chrome

Execution

Paint component renders misleading UI element

Impact

Victim acts on spoofed interface (e.g., enters credentials)

Access

Host crafted HTML page on attacker server

Delivery

Deliver link to victim via phishing or ad network

Exploit

Victim opens page in unpatched Chrome

Execution

Paint component renders misleading UI element

Impact

Victim acts on spoofed interface (e.g., enters credentials)

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim actively visits a crafted HTML page controlled by the attacker, establishing a mandatory user-interaction prerequisite (UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges but dependent on user interaction (UI:R), with integrity-only impact (I:L) and no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page designed to trigger the Paint rendering flaw and distributes the link via phishing email or malicious advertisement. When a victim running an unpatched Chrome version visits the page, the browser misrepresents a UI element - such as displaying a spoofed security dialog or a falsified origin indicator - causing the user to trust and interact with deceptive content. …
Remediation	The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, which was released in the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.