What is the CVSS score of CVE-2026-13994?

CVE-2026-13994 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13994?

Yes, a patch is available for CVE-2026-13994. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13994

EUVD-2026-40682 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-6p29-h75q-5332

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

AV:N reflects web-based delivery; UI:R is mandatory since user must interact with the spoofed credential prompt; I:L captures misleading UI integrity impact with no confidentiality or availability effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:42 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via crafted HTML page in Google Chrome's Credential Management implementation on Android (all versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent credential-related interface elements, potentially tricking users into submitting credentials to unintended destinations. The vulnerability is platform-scoped to Android and requires user interaction with the malicious page. No active exploitation has been confirmed - the CVE is absent from CISA KEV, EPSS stands at 0.17% (7th percentile), and SSVC lists exploitation status as none.

Technical ContextAI

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), meaning Chrome's Credential Management API on Android fails to correctly represent or constrain UI elements in a security-sensitive context. The Credential Management API is a browser-level interface that surfaces password autofill prompts, federated login choosers, and credential storage dialogs. An inappropriate implementation allows a crafted HTML page to influence or simulate these UI elements in ways the browser should prevent, creating a spoofed credential surface. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to 150.0.7871.47; however, the description explicitly scopes impact to Android - desktop and iOS Chrome are not described as affected.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47. Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or the device's managed update mechanism; the fix is documented in Google's stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations managing Android fleets through EMM/MDM solutions (such as Google Workspace endpoint management) should verify that Chrome auto-update policies enforce this minimum version. As a compensating control prior to patching, restricting user access to untrusted or external web content on managed Android devices reduces exposure, at the cost of user productivity. Enforcing Chrome's Safe Browsing protections and disabling credential autofill for untrusted origins via enterprise policy are additional mitigations, though these do not address the underlying implementation flaw.