What is the CVSS score of CVE-2026-14039?

CVE-2026-14039 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14039?

Yes, a patch is available for CVE-2026-14039. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14039

EUVD-2026-40726 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-97m6-c5rg-v543

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted web page (AV:N, AC:L), active victim visit required (UI:R), no attacker privileges needed (PR:N), impact limited to low integrity within browser scope only (I:L, C:N, A:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:32 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's GetUserMedia implementation prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to achieve limited cross-origin integrity impact by delivering a crafted HTML page to a victim. Chromium's own severity classification is Low, consistent with the CVSS 4.3 score and an EPSS exploitation probability of just 0.18% (8th percentile). No public exploit code and no active exploitation have been identified at time of analysis; Google has issued a remediated build in Chrome 150.0.7871.47.

Technical ContextAI

CWE-346 (Origin Validation Error) identifies failures to correctly validate or enforce the origin of incoming data or requests. GetUserMedia is a browser-native Web API (part of the MediaDevices interface) that grants web pages access to camera and microphone device streams; same-origin policy governs which page origins may invoke and share such access. The flaw in Chrome's policy enforcement layer within GetUserMedia allows a crafted cross-origin page to circumvent these restrictions, potentially enabling unintended cross-origin interactions. The EUVD entry EUVD-2026-40726 confirms the affected product is Google Chrome prior to version 150.0.7871.47; no CPE string was included in source data, but the affected surface is the Chrome stable desktop channel across platforms.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, as documented in Google's stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-update should handle this for most consumer users; enterprise administrators should verify deployment via Google Admin Console, Microsoft Intune, or equivalent endpoint management tooling and confirm the installed version meets or exceeds 150.0.7871.47. If immediate patching is operationally blocked, a targeted compensating control is to enforce a browser policy that disables GetUserMedia access for untrusted or external origins (e.g., via Chrome's MediaStreamMicAvailable and VideoCaptureAllowedUrls policies), though this will deny legitimate media capture on non-allowlisted sites. No other documented workarounds are available from the referenced advisories.