What is the CVSS score of EUVD-2026-40813?

EUVD-2026-40813 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40813?

Yes, a patch is available for EUVD-2026-40813. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-40813

| CVE-2026-14126 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-hpg9-wr8w-wg43

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page requires only user navigation (UI:R, PR:N); impact is solely UI integrity misrepresentation with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:37 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures where a browser renders security-relevant UI elements - such as the address bar, origin indicator, or SSL padlock - in a way that misrepresents the true origin of content to the user. This flaw is specific to the Android rendering path in Chrome; desktop Chrome versions are not listed as affected. The Chromium upstream bug is tracked at issues.chromium.org/issues/513992796. The affected CPE corresponds to Chrome for Android versions below 150.0.7871.47, as confirmed by both the EUVD entry (EUVD-2026-40813) and Google's stable channel release advisory.

RemediationAI

Update Google Chrome for Android to version 150.0.7871.47 or later, available via the Google Play Store or directly through Chrome's in-app update mechanism. The vendor-released patch is confirmed in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No documented workarounds exist that fully mitigate the UI spoofing without updating. As an interim compensating control, users and administrators can advise staff to type URLs directly into the address bar rather than following links from untrusted sources (email, SMS, messaging apps), which reduces but does not eliminate exposure to crafted-page delivery. Enterprise MDM policies that enforce Chrome auto-updates on Android devices will remediate this without manual user action.