What is the CVSS score of EUVD-2026-40582?

EUVD-2026-40582 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40582?

Yes, a patch is available for EUVD-2026-40582. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40582

| CVE-2026-13896 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-rwq4-2xg7-g4m8

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted HTML with no privileges needed; user must visit the page (UI:R); integrity bypass only, no confidentiality or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:28 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's Glic feature (versions prior to 150.0.7871.47) enables remote attackers to circumvent policy enforcement controls by delivering a crafted HTML page that triggers insufficient validation logic. The flaw maps to CWE-602, meaning security enforcement intended to be authoritative is implemented client-side in a bypassable manner, resulting in high integrity impact with no confidentiality or availability consequence. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability.

Technical ContextAI

Glic is Google's AI-assisted feature integrated into Chrome, enabling Gemini-powered interactions and navigation behaviors within the browser. CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause class: security policies - in this case, navigation restrictions - are enforced at the client layer in a way an attacker can subvert rather than being reliably enforced at a trusted layer. The vulnerability is specific to the Glic subsystem within Chrome, not the broader browser engine. Affected CPE resolves to Google Chrome versions preceding 150.0.7871.47 across desktop platforms. The crafted HTML page vector suggests the bypass can be triggered through DOM or scripting constructs that manipulate Glic's policy evaluation path.

RemediationAI

Update Google Chrome to stable channel version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability. The update is available via Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or through enterprise deployment tools. The fix is confirmed in the Chrome stable channel release blog at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No workarounds are documented; given that the vulnerability requires user interaction with a crafted page, disabling or restricting Glic features via enterprise Chrome policy (e.g., setting GlicEnabled to false) may reduce exposure as a compensating control, though this disables AI-assisted features entirely. Upgrading is the definitive remediation.