What is the CVSS score of CVE-2026-13992?

CVE-2026-13992 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13992?

Yes, a patch is available for CVE-2026-13992. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13992

EUVD-2026-40680 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-c5wm-vqw7-8pv3

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

Network-delivered with no authentication needed, but AC:H due to required gesture sequence; UI spoofing yields limited integrity impact only, with no plausible availability impact for this class of flaw.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:35 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome on macOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser UI elements by convincing a user to perform specific UI gestures on a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw can cause security-sensitive browser chrome - such as origin indicators or permission prompts - to display falsified content, potentially deceiving users into unsafe actions. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor has released a patch in the Chrome 150 stable channel.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where UI elements conveying security-critical signals - URL bars, TLS indicators, permission dialogs - can be obscured or falsified through improper rendering logic. The affected component is Chrome's UI layer on macOS specifically, implying the flaw may involve macOS-native windowing, gesture handling, or view rendering APIs behaving differently from other platforms. Affected versions are confirmed as Google Chrome < 150.0.7871.47 on Mac per EUVD-2026-40680. The Chromium issue tracker reference (issues.chromium.org/issues/514063409) may contain additional implementation detail but is not publicly accessible. The platform-specific scope (Mac only) distinguishes this from cross-platform Chromium rendering bugs.

RemediationAI

Update Google Chrome on macOS to version 150.0.7871.47 or later, which is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism handles this for most consumer endpoints; enterprise administrators managing Chrome via policy (Google Admin Console or Chromium enterprise bundles) should verify fleet-wide version compliance using device management tooling. As a compensating control prior to patch deployment, security teams can advise users to treat unexpected browser UI prompts or permission dialogs with suspicion, particularly on unfamiliar pages - this is a behavioral mitigation with low enforceability and does not technically eliminate the vulnerability. No other workaround is documented in the available references.