What is the CVSS score of EUVD-2026-40745?

EUVD-2026-40745 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40745?

Yes, a patch is available for EUVD-2026-40745. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40745

| CVE-2026-14058 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-q266-r9xr-rc48

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no auth required (PR:N), user must visit (UI:R), integrity-only low impact (I:L), no scope change or data exposure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

0.0 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:35 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the browser's Parser component, allowing a remote unauthenticated attacker to circumvent CSP protections via a crafted HTML page. The attacker achieves limited integrity impact (I:L) - able to load or execute content that a properly enforced CSP would block - but gains no confidentiality or availability impact. EPSS is low at 0.22% (13th percentile), no active exploitation has been confirmed (not in CISA KEV), and Chromium internally rated this Low severity, making it a real but low-priority finding.

Technical ContextAI

CWE-693 (Protection Mechanism Failure) identifies the root cause: the Chrome HTML parser does not adequately apply Content Security Policy directives during page processing. CSP is a W3C-standardized browser-side defense that restricts which scripts, stylesheets, frames, and other resources a page may load or execute, acting as a primary mitigation against cross-site scripting and data injection. When parser-level policy enforcement is incomplete, a specially crafted HTML page can cause the browser to permit resource loads or script execution that a correctly enforced CSP header would have blocked. The affected component is Chrome's parser subsystem, and the flaw exists in versions prior to 150.0.7871.47 across all platforms Chrome supports. No CPE string was provided in the source data, but the affected version range is confirmed by EUVD as Chrome < 150.0.7871.47.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this fix to most users automatically; administrators managing enterprise deployments should verify the update is applied via Chrome Browser Cloud Management or Group Policy. No specific workaround is documented for this CSP bypass, but organizations relying on CSP as a primary XSS defense in high-sensitivity environments should treat this update as time-sensitive. Temporarily restricting access to untrusted web content via proxy filtering is a partial compensating control but does not remediate the flaw and may degrade browsing functionality.