What is the CVSS score of EUVD-2026-40640?

EUVD-2026-40640 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40640?

Yes, a patch is available for EUVD-2026-40640. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40640

| CVE-2026-13952 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-30 chrome-cve-admin@google.com

GHSA-w89m-8ch9-hcx6

CSRF Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.7 MEDIUM

S:C assessed over vendor's S:U because cross-origin data leakage inherently breaches a separate security scope (another origin); other metrics match the provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 22:32 vuln.today

CVSS changed

Jul 01, 2026 - 20:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to malicious page in unpatched Chrome

Exploit

Malicious JavaScript triggers cross-origin requests to target origin

Execution

PerformanceAPI timing measurements record response deltas

Persist

Side-channel analysis infers cross-origin resource state

Impact

Attacker exfiltrates inferred data

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to malicious page in unpatched Chrome

Exploit

Malicious JavaScript triggers cross-origin requests to target origin

Execution

PerformanceAPI timing measurements record response deltas

Persist

Side-channel analysis infers cross-origin resource state

Impact

Attacker exfiltrates inferred data

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a victim user visit an attacker-controlled HTML page using an unpatched version of Google Chrome (prior to 150.0.7871.47) on any supported desktop platform (Windows, macOS, Linux). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate-to-low despite the network-exploitable vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page and social-engineers a victim into visiting it while the victim is simultaneously authenticated to a sensitive web application on another origin. The malicious page issues crafted cross-origin requests and uses PerformanceAPI timing measurements to detect response time variations, inferring the presence, absence, or partial content of protected resources on the target origin - such as whether a user is logged in, or the approximate size of a private API response. …
Remediation	Update Google Chrome to stable channel version 150.0.7871.47 or later, which contains the vendor-released patch for this issue. … Detailed patch versions, workarounds, and compensating controls in full report.