What is the CVSS score of CVE-2026-13993?

CVE-2026-13993 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13993?

Yes, a patch is available for CVE-2026-13993. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13993

EUVD-2026-40681 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-6h3x-6xr9-xjj5

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

Domain spoofing has no availability impact; AC:H and UI:R reflect required social engineering gestures; I:L captures integrity loss from misrepresented origin.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:35 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.47) allows remote attackers to misrepresent the security origin displayed to a user, enabling phishing or social engineering attacks. Exploitation requires convincing the victim to perform specific UI gestures while visiting a crafted HTML page, placing this in a moderate-complexity social engineering category. No public exploit code has been identified at time of analysis, and the vendor has released a patch in Chrome 150.0.7871.47.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where the UI incorrectly conveys security-relevant information - in this case, the origin or domain identity shown during a Web App Install flow in Chrome. The WebAppInstalls subsystem handles the installation of Progressive Web Apps (PWAs) from the browser; incorrect security UI in this context means the browser may display a trusted or incorrect domain name during the install prompt, misleading users about the true source of the application being installed. This is a presentation-layer trust failure rather than a memory corruption or code execution flaw, rooted in how Chromium renders or validates origin information during install UI gestures.

RemediationAI

The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, available via Chrome's built-in auto-update mechanism or manual download from the vendor. The vendor advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control prior to patching, enterprise administrators can disable Progressive Web App (PWA) installation via Chrome enterprise policy (WebAppInstallForceList and related policies) to remove the vulnerable attack surface, at the trade-off of losing PWA functionality for end users. User education to avoid performing browser UI gestures on unfamiliar or untrusted web pages provides marginal additional protection but is not a reliable mitigating control.