What is the CVSS score of EUVD-2026-40745?

EUVD-2026-40745 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40745?

Yes, a patch is available for EUVD-2026-40745. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40745

| CVE-2026-14058 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-q266-r9xr-rc48

Authentication Bypass Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no auth required (PR:N), user must visit (UI:R), integrity-only low impact (I:L), no scope change or data exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:35 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the browser's Parser component, allowing a remote unauthenticated attacker to circumvent CSP protections via a crafted HTML page. The attacker achieves limited integrity impact (I:L) - able to load or execute content that a properly enforced CSP would block - but gains no confidentiality or availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Craft HTML page exploiting parser CSP gap

Delivery

Host page at attacker-controlled URL

Exploit

Deliver URL to victim via phishing or redirect

Install

Victim visits page in vulnerable Chrome

Parser skips CSP enforcement

Execute

Load blocked script or resource

Impact

Execute unauthorized content in page context

Recon

Craft HTML page exploiting parser CSP gap

Delivery

Host page at attacker-controlled URL

Exploit

Deliver URL to victim via phishing or redirect

Install

Victim visits page in vulnerable Chrome

Parser skips CSP enforcement

Execute

Load blocked script or resource

Impact

Execute unauthorized content in page context

Vulnerability AssessmentAI

Exploitation	The victim must actively visit a crafted HTML page in an unpatched Chrome browser (prior to 150.0.7871.47), making user interaction (UI:R) a hard prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N signals a low-complexity, network-delivered attack requiring only user interaction - no authentication, no special privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page designed to exploit the parser's incomplete CSP enforcement and socially engineers a victim into visiting the URL - via phishing email, malicious advertisement, or compromised link. The victim's Chrome browser (pre-150.0.7871.47) parses the page, fails to correctly apply the page's CSP directives, and loads or executes content - such as an inline script or third-party resource - that the policy was intended to block. …
Remediation	Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.