What is the CVSS score of EUVD-2026-40522?

EUVD-2026-40522 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40522?

Yes, a patch is available for EUVD-2026-40522. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40522

| CVE-2026-13836 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 chrome-cve-admin@google.com

GHSA-vvh5-4937-432m

XSS Google Red Hat Suse

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered via crafted page (AV:N), no complexity or privileges needed (AC:L/PR:N), victim must visit page (UI:R), cross-origin scope change confirms S:C, limited read/write cross-origin impact (C:L/I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:28 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.1 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.

Technical ContextAI

The vulnerability is rooted in an incorrect CSS implementation within the Chromium rendering engine (CWE-79: Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). Unlike conventional reflected or stored XSS, this is a UXSS flaw, meaning the renderer itself can be manipulated to execute attacker-supplied scripts in a cross-origin context, bypassing the same-origin policy. The CVSS Scope metric is set to Changed (S:C), confirming the security boundary crossing. The affected component is Google Chrome's CSS parsing/rendering subsystem, as indicated by the 'Inappropriate implementation in CSS' classification from Google's security team. Affected CPE (inferred from EUVD): Google Chrome versions below 150.0.7871.47. The reporter via chrome-cve-admin@google.com and Chromium issue tracker entry 514420555 confirm this is an officially tracked Chromium security defect rated 'High' severity internally.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47. Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism (Settings → Help → About Google Chrome) or through enterprise management tools (Google Admin, Intune, WSUS-based deployment). The vendor advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not possible, restrict browsing to known-trusted sites using URL filtering or enterprise browser policies. Enabling Chrome's Enhanced Safe Browsing may reduce exposure to attacker-hosted malicious pages, though it does not patch the underlying CSS flaw. Organizations relying on Chrome for accessing sensitive internal web applications should prioritize rapid patch deployment given the cross-origin nature of the UXSS impact.