What is the CVSS score of EUVD-2026-40502?

EUVD-2026-40502 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40502?

Yes, a patch is available for EUVD-2026-40502. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-40502

| CVE-2026-13816 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-x454-5847-5cwh

Information Disclosure Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML page, no authentication needed, user must actively navigate; scope unchanged as leak is limited to browser context; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:25 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android prior to 150.0.7871.47 enables remote attackers to read data from other origins via a crafted HTML page exploiting insufficient validation in the File Input component. The flaw is Android-platform-specific, requiring only that a victim user navigate to an attacker-controlled page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to malicious page on Android Chrome

Exploit

File Input component processes untrusted input

Execution

Same-origin policy bypassed in file handling

Persist

Cross-origin data read from victim browser

Impact

Sensitive data exfiltrated to attacker

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to malicious page on Android Chrome

Exploit

File Input component processes untrusted input

Execution

Same-origin policy bypassed in file handling

Persist

Cross-origin data read from victim browser

Impact

Sensitive data exfiltrated to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Google Chrome on an Android device with a version prior to 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a genuine but user-interaction-dependent information disclosure risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page that abuses the File Input component to trigger cross-origin data access within Chrome on Android. A victim user browses to or is socially engineered into visiting the attacker's page, at which point the crafted input reads data from a cross-origin context - such as content from another tab or origin - and exfiltrates it to the attacker. …
Remediation	Update Google Chrome on Android to version 150.0.7871.47 or later. … Detailed patch versions, workarounds, and compensating controls in full report.