What is the CVSS score of EUVD-2026-40744?

EUVD-2026-40744 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40744?

Yes, a patch is available for EUVD-2026-40744. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40744

| CVE-2026-14057 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-8qp8-73pf-8g22

Authentication Bypass Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges needed, user must visit page (UI:R); impact limited to low integrity only with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:35 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's FedCM (Federated Credential Management) implementation allows remote attackers to perform limited cross-origin integrity manipulation by luring a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page

Delivery

Lure victim to attacker page

Exploit

Invoke FedCM API with malicious parameters

Execution

Trigger origin validation error

Persist

Bypass same-origin policy

Impact

Perform limited cross-origin integrity manipulation

Access

Host crafted HTML page

Delivery

Lure victim to attacker page

Exploit

Invoke FedCM API with malicious parameters

Execution

Trigger origin validation error

Persist

Bypass same-origin policy

Impact

Perform limited cross-origin integrity manipulation

Vulnerability AssessmentAI

Exploitation	User interaction is required - the victim must visit or be redirected to an attacker-controlled crafted HTML page using a vulnerable Chrome version prior to 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields a base score of 4.3, consistent with Chromium's own 'Low' severity designation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing JavaScript that invokes Chrome's FedCM API in a way that exploits the origin validation flaw. A victim using a vulnerable Chrome version is socially engineered into visiting the page, triggering the bypass and allowing the attacker to influence cross-origin state or responses in a limited integrity-affecting manner. …
Remediation	Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch. … Detailed patch versions, workarounds, and compensating controls in full report.