What is the CVSS score of EUVD-2026-40524?

EUVD-2026-40524 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40524?

Yes, a patch is available for EUVD-2026-40524. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40524

| CVE-2026-13838 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-cwc7-h32g-jv39

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

7.4 HIGH

SOP bypass inherently crosses origin boundaries warranting S:C; no authentication or special config required; user must visit the page (UI:R); integrity impact is cross-origin, confidentiality not demonstrated.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:29 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. Google has released a patch; no active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.22% at the 13th percentile indicates low current exploitation probability.

Technical ContextAI

CWE-346 (Origin Validation Error) describes failures to properly verify that content or requests originate from a trusted, expected origin. Google Chrome's CSS engine contains an 'inappropriate implementation' - a logic flaw in how CSS processes or resolves cross-origin resources, properties, or stylesheets - that allows a crafted page to subvert the Same-Origin Policy (SOP), a foundational browser security boundary preventing documents from one origin from interfering with resources from another. The CVSS vector's Integrity:High and Confidentiality:None profile suggests the bypass primarily enables unauthorized cross-origin writes or content injection rather than cross-origin reads. Affected product per EUVD data: Google Chrome prior to version 150.0.7871.47.

RemediationAI

Upgrade to Google Chrome version 150.0.7871.47 or later; this is the vendor-confirmed patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's automatic update mechanism will deliver this patch to most users without manual intervention - verify via chrome://settings/help. As a compensating control where immediate upgrade is not feasible, enterprise administrators can use policies to restrict navigation to untrusted external sites, deploy web filtering to block access to known-malicious HTML pages, or enable Enhanced Protection in Chrome Safe Browsing (chrome://settings/security), though none of these fully eliminate the attack surface. No workaround addresses the root CSS implementation flaw.