What is the CVSS score of EUVD-2026-40661?

EUVD-2026-40661 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40661?

Yes, a patch is available for EUVD-2026-40661. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40661

| CVE-2026-13973 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-q8q3-g5r7-6v6f

Information Disclosure Google Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

UI spoofing via crafted page requires active gesture interaction (UI:R) and high complexity (AC:H); no confidentiality or availability impact applies to a display-layer misrepresentation flaw.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:33 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in UI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome prior to 150.0.7871.47 allows a remote attacker to visually deceive users by misrepresenting browser UI elements through a crafted HTML page that requires the victim to perform specific interaction gestures. The flaw originates in an inappropriate implementation within Chrome's UI layer (CWE-451), enabling misrepresentation of critical information that could mislead users into unintended actions or false security assumptions. No public exploit code has been identified and the vulnerability is absent from CISA KEV; Google has released a fix in Chrome 150.0.7871.47.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes defects where the software renders or presents UI elements in ways that misrepresent security-relevant state to the user - for example, spoofed address bar content, false security indicators, or misleading dialog overlays. The flaw resides in Chrome's browser UI implementation layer (not the JavaScript engine or network stack), and is reachable via a crafted HTML page. The affected product is Google Chrome desktop across all supported platforms prior to version 150.0.7871.47, as confirmed by the EUVD affected-version range and Google's Stable Channel Update advisory. The internal Chromium bug tracker reference (issues.chromium.org/issues/513832989) is the primary technical source, though it may be access-restricted. No CPE strings were included in the provided intelligence data.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch per the official Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this patch automatically for most users; enterprise administrators should verify fleet-wide version compliance using browser management platforms (e.g., Google Admin Console, Intune, or equivalent) and enforce minimum version policies. No documented workarounds exist for this specific UI implementation flaw. Compensating controls are limited to user awareness training cautioning against performing unexpected UI gesture sequences on unfamiliar pages - a weak control with limited practical efficacy that should not substitute for patching.