What is the CVSS score of CVE-2026-13978?

CVE-2026-13978 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13978?

Yes, a patch is available for CVE-2026-13978. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13978

EUVD-2026-40666 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-665g-x568-wmgf

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no special conditions (AC:L), no auth required (PR:N), user must visit page (UI:R), scope unchanged, integrity impact only through UI deception (I:L), no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:44 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.

Technical ContextAI

PageInfo is the Chrome browser component surfaced when a user clicks the lock icon or info icon in the address bar, displaying security indicators such as certificate details, permissions, and site identity. CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where the UI fails to accurately represent critical security state to the user, enabling deception. Here, insufficient policy enforcement means Chrome does not correctly apply its own display rules within PageInfo when processing certain crafted HTML, potentially allowing a malicious page to influence what security information is shown. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 150.0.7871.47. The SUSE tag in the intelligence data suggests downstream Linux distribution packages (e.g., SUSE's Chromium packaging) are also affected.

RemediationAI

The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, which is confirmed available via the vendor stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch automatically for most users; enterprise deployments using managed browser policies should verify update propagation via their endpoint management tooling. For SUSE Linux systems, apply the relevant Chromium package update from SUSE's security channels. No interim workaround exists that preserves normal PageInfo functionality; organizations unable to patch immediately could restrict navigation to untrusted external sites via network policy or browser extension controls, though this has significant usability trade-offs. No compensating control can substitute for patching given the PageInfo bypass is browser-internal.