What is the CVSS score of EUVD-2026-40643?

EUVD-2026-40643 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-40643?

Yes, a patch is available for EUVD-2026-40643. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40643

| CVE-2026-13955 LOW

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-h88f-5fmx-g22j

Information Disclosure Google

3.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local file input with no privilege requirement; active user interaction mandatory; impact restricted to UI integrity spoofing with no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 22:31 vuln.today

CVSS changed

Jul 01, 2026 - 20:22 NVD

3.3 (LOW)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's CustomTabs component on Android enables a local attacker to manipulate what a victim sees within an in-app browser session by supplying a malicious file, affecting all Chrome for Android versions prior to 150.0.7871.47. The CVSS score of 3.3 (Low) and EPSS of 0.13% (3rd percentile) reflect constrained real-world impact: exploitation is local, requires user interaction, and produces only integrity-level spoofing. No active exploitation has been confirmed - this vulnerability is not listed in CISA KEV, and SSVC assessment indicates exploitation status of none.

Technical ContextAI

Chrome Custom Tabs is an Android API that allows third-party apps to embed a Chrome-powered browser session while preserving app context and native UI chrome elements such as the toolbar and URL bar. The root cause is CWE-20 (Improper Input Validation): the CustomTabs component on Android fails to sufficiently validate untrusted input sourced from a file, creating an opportunity for an attacker to inject or manipulate UI elements - such as the displayed origin or page chrome - to present deceptive content. This vulnerability is specific to the Android implementation of CustomTabs and does not extend to desktop Chrome. The affected CPE scope, per EUVD, covers Chrome for Android versions in the range below 150.0.7871.47.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in auto-update mechanism. The vendor advisory confirming this fix is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control where immediate update is not possible, restrict or disable apps that invoke the CustomTabs API with user-supplied or externally-sourced file inputs, as this limits the attack surface. Enterprise Android deployments managed via MDM can enforce minimum Chrome version policy. No known adverse side effects of applying the patch have been reported.