What is the CVSS score of EUVD-2026-40603?

EUVD-2026-40603 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40603?

Yes, a patch is available for EUVD-2026-40603. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40603

| CVE-2026-13917 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-568p-3frm-j63m

Authentication Bypass Google Apple Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N), no privileges needed (PR:N), but specific user gestures are mandatory (UI:R); only integrity is impacted through navigation bypass.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:26 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides specifically in the Chrome for iOS code path - the Chromium-derived browser running on Apple's iOS platform. iOS imposes its own WebKit engine mandate for third-party browsers, but Chrome's higher-level navigation restriction logic (distinct from the rendering engine) is what fails here. The root cause is CWE-20 (Improper Input Validation): Chrome's iOS layer does not adequately validate or sanitize inputs that govern navigation decisions when triggered via UI-gesture events. Navigation restrictions in mobile browsers typically guard cross-origin navigation, address-bar spoofing prevention, and pop-under/tab-hijacking defenses. A crafted HTML page can manipulate gesture-driven navigation events to bypass these guards. Affected CPE is inferred from EUVD data as Google Chrome on iOS versions below 150.0.7871.47.

RemediationAI

Update Google Chrome on iOS to version 150.0.7871.47 or later via the Apple App Store; this is the vendor-confirmed fix per the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations managing iOS fleets via MDM (e.g., Jamf, Intune) should push this update and verify version compliance. As a compensating control prior to patching, organizations can restrict Chrome for iOS usage via MDM policy and enforce Apple Safari (which is not affected by this Chrome-specific flaw) as the default browser. Additionally, user awareness training to avoid interacting with unsolicited links or performing unexpected UI gestures on unfamiliar pages reduces the social-engineering prerequisite. No workaround eliminates the underlying flaw; patching is the only complete remediation.