What is the CVSS score of EUVD-2026-30396?

EUVD-2026-30396 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30396?

Yes, a patch is available for EUVD-2026-30396. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-30396

| CVE-2026-8576 MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-05-14 Chrome

GHSA-qgrp-rj4f-64xh

Google Cors Misconfiguration Information Disclosure Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:26 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome on Linux and ChromeOS allows remote attackers to read sensitive data from other origins via malicious HTML pages exploiting flawed CORS implementation. Affects versions prior to 148.0.7778.168. Google released a patch in their May 2026 stable channel update. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC assessment indicates no current exploitation, non-automatable attack requiring user interaction, with partial technical impact limited to confidentiality breach.

Technical ContextAI

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that controls how web pages from one origin can access resources from different origins. This vulnerability (CWE-942) represents an inappropriate implementation of CORS policy enforcement in Chromium's rendering engine specifically on Linux and ChromeOS platforms. The flaw allows bypass of same-origin policy protections, which are fundamental to web security and prevent malicious sites from reading data from legitimate domains. The Linux/ChromeOS-specific nature suggests platform-dependent code paths in Chrome's network stack or renderer process handle CORS preflight checks or response validation incorrectly, permitting information disclosure that should be blocked by proper origin isolation.

RemediationAI

Update Google Chrome to version 148.0.7778.168 or later immediately. Chrome typically auto-updates within 24-48 hours; users can force update by navigating to chrome://settings/help. Enterprise administrators should push the update through their management consoles (Chrome Browser Cloud Management or Group Policy). Google released the patch in their May 12, 2026 stable channel update detailed at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html with technical details at https://issues.chromium.org/issues/496231853. As a temporary workaround before patching, organizations with high-risk users could disable JavaScript or use browser isolation technologies to sandbox Chrome instances, though this significantly degrades functionality. Network-level controls cannot effectively mitigate client-side CORS implementation flaws. Prioritize updating ChromeOS devices in environments handling sensitive multi-domain authentication or financial data.