What is the CVSS score of EUVD-2026-40607?

EUVD-2026-40607 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40607?

Yes, a patch is available for EUVD-2026-40607. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40607

| CVE-2026-13921 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-j5j3-r8p4-3g3f

Authentication Bypass Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N), no credentials needed (PR:N), victim must visit page (UI:R), integrity impact from SOP bypass but no confidentiality or availability consequence, scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:30 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Delivers link via phishing or malicious ad

Exploit

Victim opens page in unpatched Chrome

Execution

Crafted input triggers validation flaw in DeviceBoundSessionCredentials

Persist

Same-origin policy enforcement bypassed

Impact

Attacker script performs unauthorized cross-origin integrity actions

Access

Attacker crafts malicious HTML page

Delivery

Delivers link via phishing or malicious ad

Exploit

Victim opens page in unpatched Chrome

Execution

Crafted input triggers validation flaw in DeviceBoundSessionCredentials

Persist

Same-origin policy enforcement bypassed

Impact

Attacker script performs unauthorized cross-origin integrity actions

Vulnerability AssessmentAI

Exploitation	The victim must be running a Google Chrome desktop release prior to 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures a remotely exploitable, low-complexity attack requiring only user interaction, with a high integrity impact but no scope change and no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page that triggers insufficient input validation in Chrome's DeviceBoundSessionCredentials component, causing the browser to make erroneous cross-origin trust decisions. When a user on a vulnerable Chrome version visits the page - via a phishing link, malicious ad, or compromised site - the SOP bypass allows the attacker's script to perform integrity-impacting cross-origin operations against the victim's browser session. …
Remediation	The primary remediation is to update Google Chrome to version 150.0.7871.47 or later, confirmed available via the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.