What is the CVSS score of CVE-2026-13997?

CVE-2026-13997 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13997?

Yes, a patch is available for CVE-2026-13997. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-13997

EUVD-2026-40685 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-x7j3-f2x5-vp4g

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

Network delivery via crafted page (AV:N), gesture prerequisite raises complexity (AC:H), no attacker auth needed (PR:N), but no evident availability impact for a UI spoofing flaw (A:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:35 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in the Extensions component of Google Chrome on Android (prior to 150.0.7871.47) allows a remote attacker to misrepresent security UI elements by luring a victim into performing specific UI gestures on a crafted HTML page. The root cause (CWE-451) is incorrect rendering of security-critical extension UI, potentially misleading users about which extensions are active or what permissions they hold. No public exploit identified at time of analysis; the vendor has released a patch in the stable channel update.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where the UI does not accurately reflect security state to the user. In this case, Chrome's Extensions subsystem on Android incorrectly renders security indicators, enabling a crafted HTML page to spoof extension-related UI elements. The Android-specific scope (not present in desktop builds per the description) suggests a rendering or gesture-handling code path unique to the mobile Chromium implementation. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L indicates network delivery via a malicious web page, high attack complexity tied to the required gesture sequence, and no attacker privilege requirement. Affected CPE is inferred as Google Chrome on Android versions prior to 150.0.7871.47 based on EUVD data.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in update mechanism; this is confirmed as the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not possible, consider restricting extension usage on managed Android devices via Chrome Enterprise policy to reduce the attack surface of the Extensions UI component. User education is a meaningful compensating control given that exploitation requires convincing users to perform specific gesture sequences - training users to be suspicious of unexpected UI prompts or gesture-driven interactions on unfamiliar pages reduces exploitation probability. No known workaround eliminates the underlying rendering flaw without patching.