CVE-2026-13942 - Vulnerability Details

Description

Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Published: 2026-06-30

Score: 3.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. The impact is limited to a local user and does not extend beyond user deception, with a CVSS score of 3.3 indicating medium severity.

Affected Systems

Any ChromeOS machine running Google Chrome versions earlier than 150.0.7871.47 is affected. The 150.0.7871.47 stable channel update contains the fix and later releases are considered safe.

Risk and Exploitability

The likely attack vector is a local user who can load a malicious web page; the attacker needs local access to the device and the ability to exploit the flaw is not remotely exploitable and is a CVSS score of 3.3 and an EPSS score below 1 %, the likelihood of immediate exploitation is low, though social‑engineering scenarios may still pose a risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[0,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update Chrome on ChromeOS to version 150.0.7871.47 or newer.
If an update cannot be applied immediately, disable camera settings.
Restrict local browsing from accounts that are not required to view untrusted content, and separate user accounts if possible.

Generated by OpenCVE AI on July 17, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513186670

History

Fri, 17 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Video Capture in ChromeOS Before 150.0.7871.47

Thu, 16 Jul 2026 12:45:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Video Capture in ChromeOS Before 150.0.7871.47

Tue, 14 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing Vulnerability in Chrome Video Capture on ChromeOS

Mon, 13 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing Vulnerability in Chrome Video Capture on ChromeOS

Sun, 12 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title	ChromeOS Video Capture UI Spoofing Vulnerability

Sat, 11 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title		ChromeOS Video Capture UI Spoofing Vulnerability

Fri, 10 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title	UI Spoofing via Video Capture Module in Chrome on ChromeOS

Thu, 09 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		UI Spoofing via Video Capture Module in Chrome on ChromeOS

Thu, 09 Jul 2026 08:15:00 +0000

Type	Values Removed	Values Added
Title	ChromeOS Video Capture UI Spoofing Vulnerability

Wed, 08 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title		ChromeOS Video Capture UI Spoofing Vulnerability

Tue, 07 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Video Capture in ChromeOS Chrome

Tue, 07 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Video Capture in ChromeOS Chrome

Mon, 06 Jul 2026 12:30:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Video Capture in ChromeOS

Sun, 05 Jul 2026 23:15:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Video Capture in ChromeOS

Sun, 05 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title	ChromeOS Video Capture UI Spoofing via Crafted Webpage

Sun, 05 Jul 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title		ChromeOS Video Capture UI Spoofing via Crafted Webpage

Sat, 04 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome OS Video Capture UI Spoofing Vulnerability

Fri, 03 Jul 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome OS Video Capture UI Spoofing Vulnerability

Fri, 03 Jul 2026 09:15:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Video Capture in ChromeOS Chrome

Thu, 02 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Video Capture in ChromeOS Chrome

Thu, 02 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Crafted HTML in ChromeOS Video Capture

Thu, 02 Jul 2026 04:45:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Crafted HTML in ChromeOS Video Capture

Wed, 01 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Crafted Video Capture Page in ChromeOS

Wed, 01 Jul 2026 12:30:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Crafted Video Capture Page in ChromeOS

Wed, 01 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 08:15:00 +0000

Type	Values Removed	Values Added
Title	Local UI Spoofing via Video Capture Misimplementation in Chrome on ChromeOS

Wed, 01 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Title		Local UI Spoofing via Video Capture Misimplementation in Chrome on ChromeOS

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses		CWE-20
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513186670

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:38:30.043Z

Updated: 2026-07-01T19:28:39.055Z

Reserved: 2026-06-29T23:03:57.776Z

Link: CVE-2026-13942

Vulnrichment

Updated: 2026-07-01T19:28:33.542Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-17T14:30:17Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object