What is the CVSS score of EUVD-2026-40546?

EUVD-2026-40546 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40546?

Yes, a patch is available for EUVD-2026-40546. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40546

| CVE-2026-13860 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-w3r9-fpv5-f824

Information Disclosure Google Microsoft Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

4.2 MEDIUM

UI spoofing of Autofill security indicators may expose saved credential data (C:L); no availability impact is expected from a rendering-layer flaw, making A:N more accurate than the vendor-assigned A:L.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:23 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Autofill component on Windows (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users into interacting with forged security UI elements by convincing them to perform specific on-page gestures against a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an adversary to obscure or fabricate Autofill security indicators, potentially tricking users into submitting saved credentials or personal data to attacker-controlled destinations. No public exploit or CISA KEV listing has been confirmed; Google has released a fix in stable channel version 150.0.7871.47.

Technical ContextAI

Google Chrome's Autofill subsystem manages automatic form-filling for saved passwords, addresses, and payment data, surfacing interactive overlay UI elements directly within the browser viewport. CWE-451 identifies the root cause class: the browser fails to render security-critical UI indicators correctly, creating a gap between what the user perceives as trusted browser-native chrome and what is actually rendered by or in response to page content. On Windows specifically, the Autofill overlay rendering path contains the defect, meaning the spoofed UI can be indistinguishable from genuine browser security prompts. Affected versions span all Chrome for Windows releases below 150.0.7871.47, as confirmed by EUVD-2026-40546. The Chromium issue tracker entry at https://issues.chromium.org/issues/417052041 contains additional technical detail.

RemediationAI

Update Google Chrome on Windows to version 150.0.7871.47 or later, available via the stable channel and documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Most consumer and enterprise deployments with auto-update enabled will receive this silently; IT administrators should verify version compliance via chrome://settings/help or fleet management tooling. If immediate patching is blocked by change-freeze policies, disabling the Autofill feature entirely via chrome://settings/autofill eliminates the vulnerable surface at the cost of user convenience for saved credential and form-fill workflows. Deploying URL filtering or enterprise web proxies to block access to untrusted or unknown domains reduces the likelihood of users reaching crafted pages, but does not constitute a full mitigation since attacker pages can be hosted on compromised legitimate domains.