What is the CVSS score of EUVD-2026-40697?

EUVD-2026-40697 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-40697?

A critical code execution vulnerability in Google Chrome (CVE-2026-14009) affects all company employees running versions prior to 150.0.7871.47.. A patch is available.

How to fix or mitigate EUVD-2026-40697?

Within 24 hours: distribute a mandatory security alert to all staff and generate a complete inventory of systems running affected Chrome versions to understand exposure scope. Within 7 days: deploy Google Chrome version 150.0.7871.47 or later organization-wide via your patch management platform, prioritizing endpoints in security-sensitive roles. Within 30 days: confirm 100% remediation through endpoint audits, integrate the patched version into your standard desktop builds, and establish monitoring for any future exploitation reports.

Google Chrome EUVD-2026-40697

| CVE-2026-14009 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-wwwr-jj94-jrp5

Information Disclosure Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page reachable over the network with low complexity and no auth but requiring a victim page visit (UI:R); heap corruption in the renderer yields high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:22 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in the Passwords component of Google Chrome desktop before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and likely code execution in the renderer. Rated CVSS 8.8 (Chromium severity Medium), it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and CISA SSVC records no observed exploitation.

Technical ContextAI

The flaw resides in Chrome's Passwords subsystem (password manager/autofill handling), part of the Chromium browser engine that renders untrusted web content in the renderer process. NVD classifies the root cause as CWE-20 (Improper Input Validation), meaning insufficient validation of attacker-influenced input leads to heap corruption - an out-of-bounds or use-after-free style memory-safety condition on the heap. Because Chromium ships in Chrome and downstream browsers, the affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop builds prior to the fixed version, and the same engine code is redistributed by vendors such as SUSE (per tags) and other Chromium-based browsers.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the built-in updater (Settings > About Google Chrome) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed fleets, push the update through enterprise policy or your OS package channel, and for Chromium-based/SUSE-repackaged browsers apply the corresponding rebased build when available (EUVD reference https://nvd.nist.gov/vuln/detail/CVE-2026-14009). No supported standalone workaround fully neutralizes a renderer memory-corruption bug; as interim compensating controls you can enforce Chrome's Site Isolation and Enhanced Safe Browsing to raise exploitation cost, restrict browsing to trusted sites via policy, and deploy web/URL filtering to reduce exposure to malicious pages - these reduce but do not eliminate risk and do not substitute for the update.