What is the CVSS score of EUVD-2026-40662?

EUVD-2026-40662 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by EUVD-2026-40662?

Google Chrome on macOS versions prior to 150.0.7871.47 contains a Safe Browsing bypass vulnerability that allows attackers to circumvent protections designed to block malware and phishing sites if…. A patch is available.

How to fix or mitigate EUVD-2026-40662?

Within 24 hours, identify and document the scope of macOS systems running Chrome in your environment. Within 7 days, deploy Chrome 150.0.7871.47 or later through your standard patch management process; Chrome users with auto-updates enabled will receive the fix automatically. Within 30 days, complete a compliance verification to confirm all macOS Chrome installations are at version 150.0.7871.47 or later.

Google EUVD-2026-40662

| CVE-2026-13974 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-30 chrome-cve-admin@google.com

GHSA-4hmj-jq37-hmf2

Buffer Overflow Google Red Hat

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:44 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.1

DescriptionCVE.org

Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.