What is the CVSS score of CVE-2026-13996?

CVE-2026-13996 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13996?

Yes, a patch is available for CVE-2026-13996. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13996

EUVD-2026-40684 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-33j7-4593-xh6r

Information Disclosure Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Crafted page is remotely served (AV:N, AC:L, PR:N); user must interact with spoofed dialog (UI:R); integrity is high as false permission grants alter security state; no scope change, confidentiality, or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:27 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Permissions subsystem prior to version 150.0.7871.47 allows a remote attacker to misrepresent permission dialogs or security indicators to users via a crafted HTML page, potentially inducing unintended browser permission grants (camera, microphone, geolocation, notifications). The flaw is classified as medium severity, with no active exploitation confirmed - CISA KEV listing is absent, no public POC is known, and EPSS places exploitation probability at 0.17% (7th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.

Technical ContextAI

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), meaning the Chrome Permissions subsystem fails to correctly enforce boundaries that prevent attacker-controlled page content from altering, overlaying, or spoofing security-critical UI elements - specifically the permission prompt mechanism. Chrome's permission system is responsible for mediating origin-level capability grants; when its implementation behaves inappropriately in response to crafted HTML, the displayed prompt no longer faithfully represents the true security context, breaking the trust model users rely upon to make informed grant decisions. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop builds prior to 150.0.7871.47.

RemediationAI

The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patched version confirmed by the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should apply this transparently for most users; administrators should verify the installed version is at or above 150.0.7871.47 via chrome://settings/help. SUSE users running repackaged Chromium should apply the corresponding distribution package update via zypper or the SUSE update channel once published. As a compensating control prior to patching, users and enterprise policy managers can configure Chrome to block all permission requests from unknown or untrusted origins using chrome://settings/content - the trade-off is that this will also block legitimate permission prompts from sites that have not been pre-approved.