What is the CVSS score of EUVD-2026-40528?

EUVD-2026-40528 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40528?

Yes, a patch is available for EUVD-2026-40528. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40528

| CVE-2026-13842 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-76xp-9pf8-pqhv

Information Disclosure Google Apple Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring user to visit the page (UI:R); only the address bar display is affected (I:L), with no confidentiality or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:38 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.

Technical ContextAI

CWE-451 describes failures in the UI layer where security-critical information - in this case the URL displayed in the Omnibox (Chrome's unified address/search bar) - is misrepresented to the user. The Chromium project maintains separate iOS-specific codepaths because iOS WebKit restrictions require a substantially different rendering and navigation stack compared to Blink on other platforms; this divergence is historically a source of implementation-specific edge cases not present on desktop builds. The vulnerability arises from an 'inappropriate implementation' (Google's taxonomy for logic/design flaws rather than memory-safety bugs) that allows a crafted HTML page to influence what URL the Omnibox renders, decoupling the displayed origin from the actual document origin. No CPE string was supplied, but EUVD confirms the affected range as all Chrome for iOS versions below 150.0.7871.47.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome release advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and EUVD-2026-40528. For environments where immediate updating is constrained by mobile device management policy, a compensating control is to enforce Chrome version minimums through MDM tooling (e.g., Jamf, Microsoft Intune) and flag out-of-compliance devices. Organizations with high-risk user populations (finance, healthcare) should additionally reinforce user awareness training around verifying URLs through alternative means (e.g., certificate details, in-app browser prompts) rather than relying solely on the address bar. No meaningful network-layer mitigations apply, as the attack surface is browser-local. There are no known side effects to updating Chrome on iOS.