What is the CVSS score of EUVD-2026-40679?

EUVD-2026-40679 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40679?

Yes, a patch is available for EUVD-2026-40679. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40679

| CVE-2026-13991 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-c4hj-4cx7-w3fj

Information Disclosure Google Apple Red Hat

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring active user navigation; spoofing achieves limited integrity effect only with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:42 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.

Technical ContextAI

The vulnerability exists in Google Chrome's iOS implementation (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which is distinct from Chrome on other platforms because Apple's App Store policies require use of the WebKit rendering engine rather than Blink. This means Chrome for iOS has its own input-handling and UI-rendering layer. CWE-20 (Improper Input Validation) indicates that attacker-controlled HTML content is not adequately sanitized or constrained before being used to influence UI presentation - allowing crafted pages to manipulate visual elements such as the address bar, origin indicators, or overlay dialogs. This class of flaw is commonly exploited in phishing scenarios where the visual trust signals of the browser can be overridden or obscured.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed fix as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and EUVD-2026-40679. Organizations managing iOS device fleets via MDM solutions (e.g., Jamf, Intune) should enforce a minimum Chrome version policy of 150.0.7871.47 to ensure enterprise-wide compliance. Prior to patching, a compensating control is to advise users to independently verify the URL and site identity before entering sensitive information in Chrome on iOS, particularly when arriving via unsolicited links - though this control is behavioral and unreliable. No technical workaround fully neutralizes the spoofing surface short of updating the application.