What is the CVSS score of CVE-2026-13979?

CVE-2026-13979 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13979?

Yes, a patch is available for CVE-2026-13979. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13979

EUVD-2026-40667 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-7v9m-g8gq-4fmx

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted HTML page with required user interaction; no auth needed; integrity-only impact from UI misrepresentation with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:44 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.

Technical ContextAI

The vulnerability resides in the Paint component of the Chromium rendering engine - the subsystem responsible for compositing and drawing visual elements to the screen. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as a failure to properly constrain how a crafted HTML page can influence the rendering of browser UI chrome, potentially allowing attackers to falsify security indicators, overlay misleading content, or distort address bar representation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, spanning all Chrome platform builds prior to 150.0.7871.47. The Chromium issue tracker entry (https://issues.chromium.org/issues/513988889) likely contains deeper technical detail but may be access-restricted per Google's disclosure policy.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later immediately via the built-in browser updater at chrome://settings/help or by referencing the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. SUSE Linux administrators should apply updated chromium packages from SUSE's official repositories once a patched build is published - no separate SUSE advisory URL was provided in the available data. No documented workaround exists for this vulnerability; organizations that cannot immediately deploy the patch can reduce exposure by enforcing safe browsing controls at the proxy or DNS layer to block access to unknown external URLs, though this does not eliminate the vulnerability and imposes usability trade-offs. Chrome's auto-update mechanism typically propagates patches within 24-48 hours for consumer and managed enterprise deployments, making this a low-friction remediation in most environments.