What is the CVSS score of CVE-2026-13981?

CVE-2026-13981 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13981?

Yes, a patch is available for CVE-2026-13981. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13981

EUVD-2026-40669 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-vjqp-w4wv-vwj4

Information Disclosure Apple Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L), no auth needed (PR:N), user must visit page (UI:R), only UI integrity is affected with no scope change or confidentiality/availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 20:24 vuln.today

CVSS changed

Jul 01, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables a remote attacker to misrepresent page identity or security state through a specially crafted HTML page, exploiting an inappropriate implementation classified under CWE-451. The vulnerability affects only the iOS-specific Chrome codebase - not Chrome on other platforms - and requires user interaction (visiting an attacker-controlled page). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page exploiting iOS Chrome UI flaw

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

User navigates to page in Chrome on iOS

Execution

Spoofed UI element misrepresents page origin or security state

Impact

User deceived into disclosing credentials or approving sensitive action

Access

Craft malicious HTML page exploiting iOS Chrome UI flaw

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

User navigates to page in Chrome on iOS

Execution

Spoofed UI element misrepresents page origin or security state

Impact

User deceived into disclosing credentials or approving sensitive action

Vulnerability AssessmentAI

Exploitation	The victim must actively navigate to or be redirected to a crafted HTML page in Chrome on iOS - confirmed by UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a network-delivered, low-complexity, unauthenticated attack requiring only user interaction with integrity-only impact and no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker distributes a phishing link (via email, SMS, or social media) pointing to a crafted HTML page. When a victim on an iOS device opens the link in Chrome prior to 150.0.7871.47, the page manipulates Chrome's iOS UI elements - such as the address bar or security lock icon - to display a trusted origin (e.g., a banking domain) while serving attacker-controlled content, deceiving the user into submitting credentials or authorizing a sensitive action. …
Remediation	Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store. … Detailed patch versions, workarounds, and compensating controls in full report.