What is the CVSS score of EUVD-2026-40600?

EUVD-2026-40600 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-40600?

Yes, a patch is available for EUVD-2026-40600. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40600

| CVE-2026-13914 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-hp82-6qcx-x2xc

Authentication Bypass Google Red Hat Suse

5.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local vector and required user interaction match file-based trigger; C:H reflects password data exposure; no integrity or availability impact applies.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:27 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

5.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.5

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Chrome's built-in Passwords subsystem on macOS leaks sensitive process memory contents when a malicious file is processed, potentially exposing stored credentials or authentication tokens to a local attacker. All Google Chrome releases for Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the confidentiality impact is rated High given the nature of the data at risk within the Passwords feature.

Technical ContextAI

CWE-284 (Improper Access Control) identifies the root cause as a failure to properly restrict access to sensitive memory regions within Chrome's Password manager component on macOS. The 'inappropriate implementation' phrasing used by Google typically denotes logic or design errors - in this case likely insufficient memory isolation, improper scoping of credential buffers, or failure to sanitize sensitive values after use within the Passwords subsystem. The vulnerability is Mac-specific, suggesting it is tied to platform-level file handling APIs or macOS-specific IPC/memory mechanisms that interact with Chrome's password storage layer. When a specially crafted file is opened, it appears to trigger a code path that exposes in-memory credential data beyond its intended scope.

RemediationAI

The primary fix is to update Google Chrome on macOS to version 150.0.7871.47 or later, which contains the vendor-released patch per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates can be applied via Chrome's built-in auto-update mechanism (Help > About Google Chrome) or by downloading the latest release directly from Google. As a compensating control prior to patching, avoid opening untrusted files while Chrome is running with an active saved-password session; additionally, consider temporarily disabling Chrome's built-in password manager (chrome://settings/passwords) in favor of a standalone password manager to reduce the attack surface - note that doing so removes autofill and credential synchronization functionality.