What is the CVSS score of EUVD-2026-40701?

EUVD-2026-40701 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40701?

Yes, a patch is available for EUVD-2026-40701. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40701

| CVE-2026-14013 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-7gcf-rq6f-9j9j

Information Disclosure Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring victim navigation (UI:R, PR:N); impact is visual deception only, limiting integrity to L and excluding confidentiality and availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:43 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome prior to version 150.0.7871.47 is caused by an inappropriate SVG rendering implementation, enabling remote attackers to visually misrepresent browser UI elements through a crafted HTML page. Exploitation requires user interaction - the victim must visit a malicious page - and the direct impact is limited to integrity via visual deception, with no confidentiality or availability consequence. No public exploit has been identified and the EPSS score of 0.17% (7th percentile) confirms minimal exploitation activity at time of analysis.

Technical ContextAI

The root cause is CWE-451 (UI Misrepresentation of Critical Information), a class of flaw where software renders misleading visual information that causes users to make insecure decisions. The vulnerable component is Chrome's SVG (Scalable Vector Graphics) rendering engine. SVG is a W3C standard integrated deeply into browser rendering pipelines; it supports transforms, overlays, filters, and DOM manipulation that can, when implemented incorrectly, allow crafted SVG elements to visually obscure or mimic trusted browser UI - such as address bars, padlock indicators, permission prompts, or page origin labels. The inappropriate implementation in Chrome's SVG stack allows precisely this class of visual deception via a crafted HTML page. Affected product is Google Chrome desktop prior to version 150.0.7871.47, as confirmed by EUVD affected version range and the Google Chrome stable channel advisory.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later - this is the vendor-confirmed patched release per the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates on most consumer installs; enterprise administrators using Chrome Browser Cloud Management should verify deployment status and force update rollout via policy. No formal workarounds have been published by Google for this SVG implementation flaw. As a compensating control, organizations can restrict navigation to untrusted external URLs via enterprise URL filtering policies, though this carries significant usability trade-offs. Disabling JavaScript or SVG globally is technically possible via extension or policy but would break the majority of modern web applications and is not a practical mitigation for most deployments.