What is the CVSS score of EUVD-2026-34371?

EUVD-2026-34371 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by EUVD-2026-34371?

Google Chrome prior to version 149.0.7827.53 contains a same-origin policy bypass in DevTools that allows remote attackers to violate browser security boundaries when users interact with…. A patch is available.

How to fix or mitigate EUVD-2026-34371?

Within 24 hours: Inventory all Chrome deployments and notify endpoint owners. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed systems through your standard patch management workflow. Within 30 days: Verify deployment completion and audit for any exploitation attempts during the unpatched window.

Google Chrome EUVD-2026-34371

| CVE-2026-10922 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-rw2x-r9c4-8p2x

Authentication Bypass Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:38 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's DevTools component prior to version 149.0.7827.53 allows remote attackers to violate browser security boundaries when victims perform specific UI gestures on attacker-controlled pages. The flaw stems from insufficient validation of untrusted input within DevTools and is rated High severity by Chromium with a CVSS of 8.8, though no public exploit identified at time of analysis and EPSS is very low at 0.02%.

Technical ContextAI

Chrome DevTools is the browser's built-in developer instrumentation suite, which has privileged access to inspect pages, network traffic, and runtime state. The underlying weakness is CWE-20 (Improper Input Validation), where DevTools fails to properly sanitize or validate untrusted data delivered via malicious network traffic. Because DevTools sits inside the trusted browser surface, weak validation here can be leveraged to defeat the Same-Origin Policy (SOP) - the foundational web security boundary that isolates content from different origins - letting attacker-controlled content read or interact with data from unrelated origins.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome to 149.0.7827.53 or later on all desktop platforms via the Stable channel auto-update (Help > About Google Chrome) as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in the Chromium issue tracker at https://issues.chromium.org/issues/499164652. If immediate patching is not possible, compensating controls include enterprise policy to disable DevTools for end users (DeveloperToolsAvailability = DeveloperToolsDisallowed via Chrome Enterprise policy), which removes the vulnerable code path but breaks legitimate developer workflows, and standard user-awareness measures advising staff not to follow unsolicited prompts to perform UI gestures inside DevTools or on untrusted pages; downstream Chromium-based browser users should track their own vendor's matching update.