What is the CVSS score of EUVD-2026-40588?

EUVD-2026-40588 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40588?

Yes, a patch is available for EUVD-2026-40588. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40588

| CVE-2026-13902 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-j9h6-gxr9-jmmx

Information Disclosure Google Apple Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered, no attacker privileges needed, but active user visit required (UI:R); impact limited to integrity via UI deception with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:42 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.

Technical ContextAI

CWE-451 describes a class of vulnerabilities where an application fails to correctly render or protect critical UI elements, allowing an attacker to present misleading information - such as a spoofed URL, fabricated security dialog, or fake permission prompt - to the user. Google Chrome on iOS operates under Apple's WebKit/WKWebView mandate, meaning it uses a different rendering pipeline than desktop Chromium (Blink/V8). This iOS-specific implementation introduced an 'inappropriate implementation' in how certain HTML constructs affect browser UI rendering, creating a surface not present on other platforms. The affected CPE covers all Google Chrome for iOS releases prior to 150.0.7871.47, as confirmed by EUVD-2026-40588 and the vendor advisory. Desktop Chrome on Windows, macOS, and Linux is not in scope for this specific flaw.

RemediationAI

The primary remediation is to upgrade Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise MDM administrators managing iOS device fleets should push the updated Chrome version through their mobile device management platform and verify version compliance via inventory tooling. If patching is temporarily delayed, a practical compensating control is to instruct users to independently verify URLs in Safari (Apple's default browser) before entering credentials, since the flaw is isolated to Chrome for iOS; however, this is a user-education measure, not a technical control, and carries the trade-off of user compliance. No infrastructure-level network controls effectively mitigate a client-side UI spoofing flaw of this nature. Patch version 150.0.7871.47 is explicitly confirmed in the vendor advisory and EUVD data.