What is the CVSS score of EUVD-2026-40813?

EUVD-2026-40813 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40813?

Yes, a patch is available for EUVD-2026-40813. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-40813

| CVE-2026-14126 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-hpg9-wr8w-wg43

Information Disclosure Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page requires only user navigation (UI:R, PR:N); impact is solely UI integrity misrepresentation with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:37 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker creates spoofing-capable HTML page

Delivery

Delivers link via phishing/SMS/ad network

Exploit

Android Chrome user clicks link

Execution

Chrome renders incorrect security UI showing spoofed domain

Persist

User trusts false origin indicator

Impact

User submits credentials or sensitive data to attacker

Access

Attacker creates spoofing-capable HTML page

Delivery

Delivers link via phishing/SMS/ad network

Exploit

Android Chrome user clicks link

Execution

Chrome renders incorrect security UI showing spoofed domain

Persist

User trusts false origin indicator

Impact

User submits credentials or sensitive data to attacker

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome for Android at a version below 150.0.7871.47 - desktop Chrome users are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores 4.3 Medium, driven primarily by low attack complexity and no privilege requirement, but substantially limited by mandatory user interaction (UI:R) and a low integrity-only impact with no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page engineered to trigger Chrome for Android's incorrect security UI rendering, making the browser display a spoofed domain (e.g., a legitimate-looking bank or enterprise login URL) in the address bar or origin indicator while the user is actually on an attacker-controlled site. The attacker delivers a link to this page via phishing email, SMS, or malicious advertisement targeting Android users. …
Remediation	Update Google Chrome for Android to version 150.0.7871.47 or later, available via the Google Play Store or directly through Chrome's in-app update mechanism. … Detailed patch versions, workarounds, and compensating controls in full report.