What is the CVSS score of CVE-2026-13984?

CVE-2026-13984 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13984?

Yes, a patch is available for CVE-2026-13984. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13984

EUVD-2026-40672 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-8xxp-h8m6-wxx9

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML with no auth required (PR:N), but demands active victim navigation (UI:R); impact is UI deception only, so I:L and C/A remain N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:28 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionNVD

Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's TabStrip component, fixed in version 150.0.7871.47, enables remote attackers to misrepresent browser security indicators through specially crafted HTML pages. The incorrect security UI rendering in the tab strip allows an attacker to deceive users about the true origin or security state of a webpage, creating phishing-enablement risk. No public exploit code and an EPSS of 0.17% (7th percentile) indicate low exploitation likelihood at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where the UI fails to accurately convey security-relevant information to the user. In Chrome, the TabStrip is the browser component responsible for rendering individual tab elements - including tab titles, favicons, and contextual security indicators. When this component processes a crafted HTML page, it can render incorrect or misleading security UI elements, potentially allowing the displayed origin, security padlock, or tab identity to diverge from the actual loaded resource. This class of vulnerability is distinct from code execution flaws; its impact is limited to deceiving the user's perception of page trust. The affected CPE is Google Chrome prior to 150.0.7871.47 on all supported desktop platforms.

RemediationAI

The primary remediation is to update Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify the update has been applied via policy or endpoint management tooling. If immediate patching is not possible, a compensating control is to restrict or block navigation to untrusted external URLs through a web proxy or DNS filtering layer, reducing the likelihood users encounter crafted pages; however, this does not eliminate the underlying flaw and may impact legitimate browsing. There are no known configuration-level workarounds that neutralize this specific TabStrip rendering issue.