CVE-2026-13979 is a medium severity vulnerability in Google Chrome's Paint component that enables remote attackers to conduct UI spoofing by crafting malicious HTML pages. This vulnerability affects versions prior to 150.0.7871.47. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, and user interaction needed. The vulnerability does not compromise confidentiality or availability but can mislead users by spoofing the user interface. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

The vulnerability allows an attacker to perform UI spoofing, potentially misleading users into interacting with deceptive interface elements. There is no direct impact on confidentiality or availability. The integrity impact is limited to the potential for user deception. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update to version 150.0.7871.47 or later once confirmed to contain the fix. Until then, exercise caution when interacting with untrusted web content.