What is the CVSS score of EUVD-2026-40688?

EUVD-2026-40688 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40688?

Yes, a patch is available for EUVD-2026-40688. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40688

| CVE-2026-14000 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 chrome-cve-admin@google.com

GHSA-rh5w-c9h6-6q3x

XSS Google Red Hat

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered UXSS requiring victim navigation (UI:R) with scope change (S:C) reflecting cross-origin impact; C:L/I:L consistent with Chromium's own medium severity and bounded per-session blast radius.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:26 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's XML implementation permits remote attackers to inject arbitrary scripts or HTML into cross-origin browsing contexts by enticing a victim to visit a crafted HTML page. All Chrome desktop versions prior to 150.0.7871.47 are affected, with the flaw rooted in improper XML handling that bypasses the browser's same-origin policy enforcement. Despite the inherently high practical impact of UXSS, EPSS sits at 0.17% (7th percentile) and SSVC records exploitation status as none with no KEV listing, indicating no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), but manifests as a Universal XSS, a browser-level variant that is fundamentally different from application-level XSS. Rather than a web application failing to sanitize user input, the flaw lies inside Chrome's own XML parsing or rendering subsystem, which inappropriately handles certain constructs in a way that allows script injection to escape the same-origin policy. UXSS is especially dangerous because injected scripts execute with the trust level of any origin the victim has open in the browser - not merely the origin of the attacker's page. The affected product is Google Chrome across all desktop platforms (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), and the CVSS S:C (scope changed) metric formally reflects this cross-origin reach. The fix was shipped in stable channel version 150.0.7871.47.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later immediately via the browser's built-in update mechanism (chrome://settings/help) or through the system package manager. The vendor advisory confirming this fix is at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. SUSE Linux users should apply updated Chromium packages from SUSE's security advisories. If patching cannot be applied immediately, enterprise administrators can deploy Chrome policies to restrict navigation to untrusted or uncategorized sites using SafeBrowsing Enhanced Protection or URL allowlisting via Chrome Enterprise policy - however, this carries significant usability trade-offs and does not eliminate risk from compromised legitimate sites. Disabling JavaScript via policy is an aggressive workaround that eliminates UXSS exploitation but breaks most modern web functionality. Prioritize patching over workarounds given the fix is vendor-released.