What is the CVSS score of CVE-2026-13980?

CVE-2026-13980 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13980?

Yes, a patch is available for CVE-2026-13980. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13980

EUVD-2026-40668 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-xxpp-m3m6-m3rm

Information Disclosure Google Apple Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no auth needed, but user must visit; UI misrepresentation yields only low integrity impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:43 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where UI elements fail to accurately convey security-critical state to the user. Chrome for iOS operates within Apple's iOS WebKit constraints and has platform-specific rendering and UI management code separate from the desktop Chromium engine. The 'inappropriate implementation' classification suggests Chrome's iOS-specific UI layer contains logic that can be manipulated by attacker-controlled HTML or JavaScript to render misleading UI elements - such as spoofed address bar content, fabricated security lock icons, or overlay elements that obscure legitimate browser chrome. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) provided is generic; the vulnerability is explicitly scoped to the iOS platform per the CVE description.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store, which constitutes the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No documented workaround exists for this UI-layer flaw; disabling JavaScript may reduce attack surface but would break most web functionality and is not a practical production control. Organizations managing iOS device fleets via MDM should push the App Store update through managed app channels. Given the Low-integrity, no-confidentiality impact and absence of active exploitation, this patch can be incorporated into normal update cycles rather than emergency deployment.