What is the CVSS score of EUVD-2026-40753?

EUVD-2026-40753 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40753?

Yes, a patch is available for EUVD-2026-40753. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40753

| CVE-2026-14066 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-48fg-hm4c-87fc

Authentication Bypass Apple Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML page (AV:N, AC:L), no attacker privileges required (PR:N), victim must visit the page (UI:R), impact is integrity-only navigation bypass with no confidentiality or availability consequence (I:L, C:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:36 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker domain

Delivery

Lure iOS Chrome user via phishing or malicious link

Exploit

User opens link in Chrome for iOS

Execution

Insufficient input validation triggered in navigation handler

Persist

Navigation restriction bypass achieved

Impact

User silently redirected to restricted or unintended origin

Access

Host crafted HTML page on attacker domain

Delivery

Lure iOS Chrome user via phishing or malicious link

Exploit

User opens link in Chrome for iOS

Execution

Insufficient input validation triggered in navigation handler

Persist

Navigation restriction bypass achieved

Impact

User silently redirected to restricted or unintended origin

Vulnerability AssessmentAI

Exploitation	The vulnerability requires the target device to be running Google Chrome on iOS - the flaw is specific to the iOS platform and does not affect Chrome on any other operating system. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores 4.3 and maps to a network-reachable, low-complexity exploit with no privilege requirement, but it is gated on user interaction - the victim must navigate to the attacker's page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and hosts a crafted HTML page engineered to trigger Chrome for iOS's input validation flaw in its navigation handling code. The attacker distributes a link to this page via phishing email, SMS smishing, or a malicious advertisement targeting iOS users. …
Remediation	Update Google Chrome for iOS to version 150.0.7871.47 or later, available through the Apple App Store. … Detailed patch versions, workarounds, and compensating controls in full report.