What is the CVSS score of EUVD-2026-34450?

EUVD-2026-34450 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34450?

Yes, a patch is available for EUVD-2026-34450. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34450

| CVE-2026-11001 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-06-04 chrome-cve-admin@google.com

GHSA-4399-c2v8-9jhj

Authentication Bypass Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:09 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Payments subsystem (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to manipulate what the victim sees during a payment flow, achieving high-integrity impact by deceiving users into authorizing fraudulent transactions or submitting payment credentials to attacker-controlled surfaces. The attack requires the victim to visit a crafted HTML page and perform specific UI gestures, as confirmed by the CVSS UI:R designation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% at the 11th percentile indicates minimal current exploitation activity despite the network-reachable attack vector.

Technical ContextAI

The vulnerability resides in Chrome's Payments subsystem, specifically the browser's implementation of the Web Payment Request API - the mechanism that surfaces native browser-rendered payment UI dialogs to users during checkout flows. CWE-290 (Authentication Bypass by Spoofing) identifies the root cause class: the implementation fails to sufficiently authenticate or validate the integrity of UI elements presented within the payment context, allowing a crafted HTML page to induce a spoofed representation. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects all Chrome platform variants (Windows, macOS, Linux, Android, iOS) below the fixed version. Chromium's internal tracking references issue 493691489. The Chromium team rated this Medium severity, consistent with the NVD CVSS 6.5 score.

RemediationAI

The primary fix is to upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators managing Chrome via Google Admin Console, Microsoft Intune, or other MDM platforms should push this update as a priority for any endpoints used in payment-related workflows. Where immediate patching is not feasible, a targeted compensating control is to disable the Payment Request API via Chrome enterprise policy (PaymentMethodQueryEnabled set to false or equivalent policy restriction) - this prevents the vulnerable payment UI from being invoked entirely, though it will break any legitimate in-browser payment flows relying on the native Payment Request API. There is no known workaround that preserves full payment functionality while mitigating the spoofing risk.