What is the CVSS score of EUVD-2026-40675?

EUVD-2026-40675 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40675?

Yes, a patch is available for EUVD-2026-40675. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40675

| CVE-2026-13987 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-pv98-3m5q-p66w

Information Disclosure Google Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered with no auth required; user must visit crafted page (UI:R); impact is integrity-only via UI misrepresentation, no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:43 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome Mobile on Android prior to version 150.0.7871.47 enables remote unauthenticated attackers to misrepresent security-critical information in the browser interface by serving a crafted HTML page. Rooted in CWE-451 (User Interface Misrepresentation of Critical Information), the flaw allows manipulation of Chrome's mobile security UI - such as origin indicators or trust signals - without requiring any privileges from the attacker. No active exploitation is confirmed (absent from CISA KEV), EPSS sits at the 7th percentile, and SSVC flags exploitation status as none, placing this firmly in the monitor-and-patch tier rather than emergency response.

Technical ContextAI

The affected component is the security UI layer of Google Chrome's mobile rendering engine on Android (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). CWE-451 describes failures where the user interface misrepresents critical security information - in mobile browsers this typically manifests as address bar spoofing, suppression of HTTPS indicators, or overlay of fake security widgets that obscure the true page origin. Mobile browsers are inherently more susceptible to this class of flaw because limited screen real estate and simplified UI chrome make it harder for users to verify origin independently. The vulnerability does not affect the underlying page rendering engine or network stack, only the trust signals surfaced to the user.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later, which is the vendor-released patch per the official Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should verify that automatic updates are active in the Google Play Store, as Chrome on Android typically updates silently in the background. Prior to patching, the most effective compensating control is user awareness: avoid following unsolicited links in SMS, email, or messaging apps, and manually verify the address bar after navigation to any sensitive site. There is no known configuration flag or feature toggle to disable the affected security UI rendering path without disabling browser functionality wholesale. Enterprise administrators managing Android fleets via MDM should push the Chrome update through their deployment pipeline and confirm version compliance via policy reporting.