What is the CVSS score of CVE-2026-13983?

CVE-2026-13983 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13983?

Yes, a patch is available for CVE-2026-13983. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-13983

EUVD-2026-40671 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-w96r-p79r-3xjj

Information Disclosure Google Apple Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

URL bar spoofing has no availability impact; AC:H and UI:R reflect the required gesture-based social engineering on iOS only.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:34 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to display falsified URL content to a victim user via a crafted HTML page. Exploitation requires convincing the target to perform specific UI gestures while visiting the malicious page, making this a phishing-enabler rather than a direct code-execution primitive. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; Google has released a fix in the 150.0.7871.47 stable channel update.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-critical UI elements can be made to display information that does not accurately reflect the underlying state. In this case, the Omnibox - Chrome's combined address-and-search bar - is the trust anchor iOS users rely on to verify site origin. The flaw exists specifically in the iOS port of Chromium, suggesting a platform-specific rendering or gesture-handling code path diverges from the standard Blink/WebKit integration in a way that allows attacker-controlled page content or scroll state to influence what the Omnibox displays. EUVD EUVD-2026-40671 confirms the affected version range as all Chrome for iOS builds below 150.0.7871.47. No CPE string was provided, but the scope is unambiguously limited to the iOS platform build of Google Chrome.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store. The vendor patch is confirmed available per the stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and corroborated by EUVD-2026-40671. No specific workaround is practical for end-users given that the flaw is in the browser's own UI rendering; disabling JavaScript is an extreme measure that would break most web functionality and is not recommended as a routine compensating control. Organizations with MDM control over iOS devices should enforce a minimum Chrome version policy via their MDM solution to ensure fleet-wide patching. End-user awareness training to verify URLs through alternative means (e.g., bookmarks, typing addresses directly) reduces phishing risk while the patch propagates.