What is the CVSS score of EUVD-2026-28129?

EUVD-2026-28129 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28129?

Yes, a patch is available for EUVD-2026-28129. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-28129

| CVE-2026-8013 MEDIUM

Improper Input Validation (CWE-20)

2026-05-06 Chrome

Information Disclosure Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page requires user interaction; confidentiality-only impact limited to partial cross-origin data leak with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:31 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.

Technical ContextAI

FedCM (Federated Credential Management) is a browser-native API introduced in Chrome to support privacy-preserving identity federation without relying on third-party cookies or cross-site tracking. The root cause is CWE-20 (Improper Input Validation): the FedCM subsystem fails to adequately validate or sanitize untrusted input derived from attacker-controlled HTML, allowing the same-origin policy enforcement to be bypassed within the FedCM flow. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome releases prior to 148.0.7778.96 across all platforms and operating systems are within scope. The cross-origin data leak class is consistent with scenarios where a browser API incorrectly exposes response data or metadata from a cross-origin identity provider interaction to the initiating (attacker-controlled) origin.

RemediationAI

Update Google Chrome to version 148.0.7778.96 or later, as confirmed by the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this fix on supported platforms; ensure auto-update is enabled and restart the browser to complete the update. For Red Hat and SUSE environments running packaged Chromium, monitor respective distribution security advisories for chromium package updates. As a compensating control prior to patching in managed enterprise environments, administrators may restrict navigation to untrusted external sites via policy or web filtering, which reduces exposure to the crafted-page delivery vector - however, this trade-off limits user browsing capability and does not address the underlying flaw.