What is the CVSS score of EUVD-2026-40701?

EUVD-2026-40701 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40701?

Yes, a patch is available for EUVD-2026-40701. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40701

| CVE-2026-14013 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-7gcf-rq6f-9j9j

Information Disclosure Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring victim navigation (UI:R, PR:N); impact is visual deception only, limiting integrity to L and excluding confidentiality and availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:43 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome prior to version 150.0.7871.47 is caused by an inappropriate SVG rendering implementation, enabling remote attackers to visually misrepresent browser UI elements through a crafted HTML page. Exploitation requires user interaction - the victim must visit a malicious page - and the direct impact is limited to integrity via visual deception, with no confidentiality or availability consequence. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft HTML page with malicious SVG overlay

Delivery

Host page on attacker-controlled server

Exploit

Deliver phishing link to victim

Execution

Victim navigates to page in vulnerable Chrome

Persist

SVG renders spoofed UI elements over browser chrome

Impact

User deceived into insecure action (e.g., credential entry)

Access

Craft HTML page with malicious SVG overlay

Delivery

Host page on attacker-controlled server

Exploit

Deliver phishing link to victim

Execution

Victim navigates to page in vulnerable Chrome

Persist

SVG renders spoofed UI elements over browser chrome

Impact

User deceived into insecure action (e.g., credential entry)

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively navigate to an attacker-controlled HTML page containing malicious SVG content, confirmed by UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 4.3 (Medium) reflects the constrained impact profile: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with scope unchanged (S:U) and only limited integrity impact (I:L, C:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a lookalike domain and hosts an HTML page embedding crafted SVG content engineered to render a convincing fake address bar or security indicator over the legitimate browser chrome, then distributes the link via a phishing email. A victim clicks the link, the malicious page loads in Chrome prior to 150.0.7871.47, and the SVG overlay causes the browser to display a spoofed origin (e.g., a trusted banking domain) - deceiving the user into entering credentials. …
Remediation	Update Google Chrome to version 150.0.7871.47 or later - this is the vendor-confirmed patched release per the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.