What is the CVSS score of EUVD-2026-40590?

EUVD-2026-40590 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40590?

Yes, a patch is available for EUVD-2026-40590. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40590

| CVE-2026-13904 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-5r37-cpm2-c6pr

Authentication Bypass Apple Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery with no privileges needed; user must visit crafted page (UI:R); only integrity impacted via navigation bypass, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:29 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page exploiting Safe Browsing bypass

Delivery

Host page on attacker-controlled domain

Exploit

Deliver link to iOS Chrome users via phishing or social engineering

Execution

Victim taps link in unpatched Chrome for iOS

Persist

Safe Browsing check silently bypassed

Impact

Browser navigates to otherwise-blocked malicious destination

Access

Craft malicious HTML page exploiting Safe Browsing bypass

Delivery

Host page on attacker-controlled domain

Exploit

Deliver link to iOS Chrome users via phishing or social engineering

Execution

Victim taps link in unpatched Chrome for iOS

Persist

Safe Browsing check silently bypassed

Impact

Browser navigates to otherwise-blocked malicious destination

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Google Chrome on an iOS device with a version prior to 150.0.7871.47 - this vulnerability does not affect Chrome on any other platform. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 6.5 (Medium) is consistent with the vector: network-reachable (AV:N), low complexity (AC:L), no authentication (PR:N), but requiring user interaction (UI:R), with no scope change and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or compromises a domain containing a crafted HTML page engineered to trigger Chrome for iOS's Safe Browsing bypass, then lures an unpatched iOS Chrome user to the page via email phishing, SMS, or social media link. Once the victim taps the link and Chrome loads the crafted page, the Safe Browsing check is bypassed, and Chrome navigates the user to a secondary phishing or malware-hosting destination that would normally be blocked by the protection mechanism. …
Remediation	Vendor-released patch: Chrome for iOS version 150.0.7871.47. … Detailed patch versions, workarounds, and compensating controls in full report.