What is the CVSS score of EUVD-2026-40703?

EUVD-2026-40703 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40703?

Yes, a patch is available for EUVD-2026-40703. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40703

| CVE-2026-14015 MEDIUM

Race Condition (CWE-362)

2026-06-30 chrome-cve-admin@google.com

GHSA-x63f-3c5p-f7p4

Information Disclosure Microsoft Race Condition Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Race condition (CWE-362) requires winning a timing window, warranting AC:H over the vendor-assigned AC:L; all other metrics reflect unauthenticated, user-interaction-required cross-origin disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:44 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted WebRTC HTML page

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome on Windows initiates WebRTC session

Execution

Race condition fires in unsynchronized WebRTC thread

Persist

Cross-origin data accessed before SOP boundary enforced

Impact

Sensitive cross-origin data exfiltrated to attacker

Access

Attacker hosts crafted WebRTC HTML page

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome on Windows initiates WebRTC session

Execution

Race condition fires in unsynchronized WebRTC thread

Persist

Cross-origin data accessed before SOP boundary enforced

Impact

Sensitive cross-origin data exfiltrated to attacker

Vulnerability AssessmentAI

Exploitation	Victim must be running Google Chrome on Windows - non-Windows Chrome installations are explicitly not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 and reflects a network-accessible, unauthenticated attack requiring only that a victim visit a malicious page, with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and hosts a crafted HTML page embedding malicious JavaScript that deliberately triggers a race condition in Chrome's WebRTC stack while the page loads. A victim on a Windows machine running unpatched Chrome visits the page - via phishing link, malvertising, or a watering-hole site - and the race condition fires during WebRTC initialization, allowing the attacker's script to read data from a cross-origin context (such as an authenticated session on another tab or embedded frame) before Chrome's Same-Origin Policy boundary is enforced. …
Remediation	Update Google Chrome on Windows to version 150.0.7871.47 or later immediately; this is the vendor-released patch confirmed in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.