What is the CVSS score of CVE-2026-13995?

CVE-2026-13995 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13995?

Yes, a patch is available for CVE-2026-13995. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13995

EUVD-2026-40683 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-jm5g-9rwj-6fh6

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Crafted HTML page is network-delivered (AV:N), requires victim visit (UI:R), no auth needed (PR:N); impact is UI spoofing only, yielding I:L with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:27 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Autofill component on Android (prior to 150.0.7871.47) allows a remote attacker to render deceptive interface elements via a crafted HTML page, exploiting insufficient input validation (CWE-20) in the Autofill subsystem. The integrity-only impact (I:L, no confidentiality or availability loss) and mandatory user interaction limit the real-world severity, consistent with Google's Chromium Medium classification. No active exploitation has been identified (SSVC: exploitation none; EPSS: 0.21%, 11th percentile), and Google has released a patch in Chrome 150.0.7871.47.

Technical ContextAI

The vulnerability resides in Chrome's Autofill subsystem specifically on the Android platform, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. CWE-20 (Improper Input Validation) indicates the Autofill component fails to adequately sanitize attacker-controlled HTML content before rendering or processing it. On Android, Chrome's Autofill interacts with web form elements and page structure to surface fill suggestions; when this pipeline does not properly validate input, a malicious HTML page can manipulate the visual rendering layer - for example, by injecting overlay elements or manipulating Autofill prompt positioning - to present a spoofed interface. This is a platform-scoped flaw: the CVE description explicitly constrains it to Chrome on Android, and desktop Chrome is not confirmed affected by this specific Autofill code path.

RemediationAI

Upgrade Google Chrome on Android to version 150.0.7871.47 or later, which resolves the Autofill input validation flaw per the Google stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. On Android, Chrome typically updates automatically through the Google Play Store; users and administrators should verify the installed version is at or above 150.0.7871.47 via chrome://settings/help. As a compensating control for environments where immediate patching is not feasible, disabling the Autofill feature in Chrome Android settings (Settings > Autofill and Passwords) eliminates the vulnerable attack surface at the cost of reduced usability for saved credentials and address autofill. No additional workarounds are documented in available references.