What is the CVSS score of CVE-2026-14057?

CVE-2026-14057 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14057?

Yes, a patch is available for CVE-2026-14057. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14057

EUVD-2026-40744 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-8qp8-73pf-8g22

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges needed, user must visit page (UI:R); impact limited to low integrity only with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:35 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's FedCM (Federated Credential Management) implementation allows remote attackers to perform limited cross-origin integrity manipulation by luring a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. With an EPSS of 0.18% (8th percentile), no CISA KEV listing, and no public exploit identified, this represents a low-probability exploitation scenario despite being trivially deliverable via a web page.

Technical ContextAI

FedCM (Federated Credential Management) is a browser-native API introduced in Chrome to facilitate federated identity flows without reliance on third-party cookies or cross-site redirects. The root cause is classified as CWE-346 (Origin Validation Error), meaning Chrome fails to correctly verify or enforce origin boundaries within the FedCM API surface. This class of flaw allows a document served from one origin to interact with or influence resources or state governed by the same-origin policy under a different origin. The affected product is Google Chrome prior to version 150.0.7871.47, as confirmed by EUVD CPE data. The FedCM feature is enabled by default in Chrome, requiring no special configuration to be in scope.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch. Users on managed endpoints should deploy this update via enterprise policy at the earliest opportunity. The release advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control for environments that cannot immediately patch, administrators may consider disabling the FedCM feature via Chrome enterprise policy (FederatedIdentityApiEnabled=false), though this will break federated login flows relying on the FedCM API and is not recommended as a long-term measure. Restricting end-user navigation to untrusted external pages via web proxy or DNS filtering reduces exposure but does not eliminate it. Chromium's upstream issue tracker reference is https://issues.chromium.org/issues/502212647.