What is the CVSS score of CVE-2026-13998?

CVE-2026-13998 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13998?

Yes, a patch is available for CVE-2026-13998. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13998

EUVD-2026-40686 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-mx29-96xm-4q25

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

Downgraded A from L to N: a UI spoofing defect in a file picker does not credibly disrupt system or application availability.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:36 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in File Input in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via the File Input security indicator in Google Chrome on macOS allows a remote attacker to misrepresent security-critical interface elements when a user visits a crafted HTML page and performs specific UI gestures. Affected are all Chrome for Mac builds prior to 150.0.7871.47. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; combined with the high attack complexity and required user interaction, real-world exploitation at scale is unlikely without a targeted social engineering component.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where security-relevant UI signals are rendered incorrectly, enabling an attacker to deceive a user about the true nature of an action. In this case the affected component is the File Input element - the browser-native control that presents a security UI (e.g., the file-picker chrome and associated origin indicators) when a page requests file access. The defect is Mac-specific, suggesting it involves macOS-native rendering paths or AppKit-level UI composition. Affected CPE: Chrome versions below 150.0.7871.47 on macOS. The Chromium issue tracker reference (issues.chromium.org/issues/514070501) and the Google Chrome Releases advisory confirm the vendor scope.

RemediationAI

Upgrade Google Chrome on macOS to version 150.0.7871.47 or later, which contains the vendor-released patch per the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy. Because exploitation requires convincing a user to perform specific UI gestures on a crafted page, a compensating control for unpatched systems is to enforce 'do not run untrusted HTML content' via browser enterprise policies (e.g., URL blocklists or managed safe-browsing enforcement); however this does not eliminate risk from attacker-controlled legitimate-looking sites. There are no known workarounds that fully neutralize the UI misrepresentation defect without patching.