What is the CVSS score of EUVD-2026-30383?

EUVD-2026-30383 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30383?

Yes, a patch is available for EUVD-2026-30383. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-30383

| CVE-2026-8566 MEDIUM

Improper Access Control (CWE-284)

2026-05-14 Chrome

GHSA-r6x2-rrqv-8cp8

Google Authentication Bypass Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 16:22 vuln.today

CVSS changed

May 15, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Google Chrome's Android payment implementation allows remote attackers to bypass access control restrictions through specially crafted HTML pages, affecting Chrome versions prior to 148.0.7778.168 on Android. The vulnerability requires user interaction (visiting a malicious page) but can be exploited remotely without authentication. EPSS exploitation probability is low (0.02%, 4th percentile), and a vendor-released patch is available. While tagged as an authentication bypass, the CVSS impact indicates only low integrity compromise with no confidentiality or availability impact.

Technical ContextAI

This vulnerability stems from insufficient policy enforcement (CWE-284: Improper Access Control) in Chrome's payment request API implementation on Android. The Payments API allows websites to request payment information from users through standardized browser interfaces. The affected component failed to properly enforce discretionary access control policies, potentially allowing unauthorized payment-related actions or information disclosure. The CPE identifier cpe:2.3:a:google:chrome confirms this affects the Google Chrome browser application. The network attack vector (AV:N) indicates the flaw can be triggered through web content, while the UI:R requirement means the attack requires user interaction with a malicious HTML page containing crafted payment request code.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.168 or later, which contains the fix for this vulnerability. Chrome typically auto-updates, but administrators of managed Android devices should verify deployment of this version through their mobile device management (MDM) platforms. For organizations unable to immediately patch, implement compensating controls by restricting user access to untrusted websites through web filtering policies, particularly sites requesting payment permissions. Consider disabling payment request API permissions via Chrome enterprise policies (PaymentMethodQueryEnabled) on managed Android devices if payment features are not business-critical, though this may impact legitimate payment workflows on trusted sites. Monitor Chrome's payment permission prompts and educate users to decline unexpected payment requests. Complete remediation details and security bulletin available at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html and technical discussion at https://issues.chromium.org/issues/470646792.