What is the CVSS score of EUVD-2026-40598?

EUVD-2026-40598 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40598?

Yes, a patch is available for EUVD-2026-40598. Update the affected software to the latest version immediately.

Chrome iOS EUVD-2026-40598

| CVE-2026-13912 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-rrcm-99r9-vqpr

Information Disclosure Google Apple Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L), no auth needed (PR:N), user must visit page (UI:R); spoofing yields low integrity impact only, no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:42 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.

Technical ContextAI

CWE-451 ('User Interface Misrepresentation of Critical Information') describes flaws where a product renders UI security cues - warnings, indicators, origin labels - in a way that can be manipulated or obscured by attacker-controlled content. In this case, the flaw resides in Chrome's Safe Browsing subsystem on iOS, which is responsible for displaying phishing/malware warnings. An 'inappropriate implementation' in that component allows a crafted HTML page to influence or spoof those UI elements. iOS imposes WebKit-layer restrictions that differ from desktop Chrome, and the platform-specific Safe Browsing integration path appears to have been the source of this divergence. The affected CPE-equivalent scope is Google Chrome for iOS prior to version 150.0.7871.47.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later, which contains the vendor-released fix. The patch is available now via the Apple App Store; users and MDM administrators should ensure all managed iOS devices running Chrome are updated to this stable channel release. The advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No specific workaround is documented, but as a compensating control for environments where immediate patching is not possible, administrators can restrict access to untrusted or external web content via Mobile Device Management (MDM) URL filtering policies - note this trades browsing functionality for reduced exposure. Switching iOS users temporarily to Safari, which uses WebKit's native Safe Browsing integration, avoids the vulnerable Chrome implementation until patching is complete.