What is the CVSS score of EUVD-2026-40741?

EUVD-2026-40741 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40741?

Yes, a patch is available for EUVD-2026-40741. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40741

| CVE-2026-14054 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-3m9m-rx9m-5pm3

Authentication Bypass Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

User must actively visit a crafted page (UI:R); navigation bypass yields only limited integrity impact with no confidentiality or availability effects and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:35 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-layer policy enforcement by inducing a user to visit a specially crafted HTML page. Rooted in CWE-602 (client-side enforcement of server-side security), the flaw means Chrome's network policy checks governing navigation can be subverted client-side, yielding a low-integrity impact with no confidentiality or availability consequence. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker-controlled server

Delivery

Lure victim to visit page via phishing or malvertising

Exploit

Chrome processes malformed navigation trigger

Execution

Insufficient network policy check is bypassed

Impact

Navigation proceeds to restriction-blocked destination

Access

Host crafted HTML page on attacker-controlled server

Delivery

Lure victim to visit page via phishing or malvertising

Exploit

Chrome processes malformed navigation trigger

Execution

Insufficient network policy check is bypassed

Impact

Navigation proceeds to restriction-blocked destination

Vulnerability AssessmentAI

Exploitation	The victim must actively visit an attacker-controlled or attacker-influenced HTML page using an unpatched version of Google Chrome (prior to 150.0.7871.47) on a desktop platform. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a narrow, user-interaction-dependent exploit path: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing manipulated navigation triggers - such as scripted redirects or specially constructed iframe attributes - designed to exploit the insufficient network policy enforcement in Chrome. A user browsing to the attacker-controlled page (via phishing link or malvertising) causes Chrome to process the crafted navigation event, bypassing a restriction that should have blocked navigation to a particular destination. …
Remediation	Update Google Chrome to version 150.0.7871.47 or later via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise software distribution channels; the advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.