What is the CVSS score of EUVD-2026-40760?

EUVD-2026-40760 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40760?

Yes, a patch is available for EUVD-2026-40760. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40760

| CVE-2026-14073 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-5x5m-vp5v-xf5w

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via crafted page (AV:N, AC:L, PR:N), mandatory user visit (UI:R), navigation bypass yields low integrity impact only (I:L, C:N, A:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:37 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's WebXR component affects all versions prior to 150.0.7871.47, exploitable by a remote unauthenticated attacker who can induce a user to visit a crafted HTML page. The root cause is insufficient input validation (CWE-20) within the WebXR subsystem, resulting in limited integrity impact via unauthorized navigation. No public exploit exists and EPSS sits at 0.18% (8th percentile), consistent with the Chromium team's own Low severity classification - this represents a genuine but low-priority risk.

Technical ContextAI

WebXR is the browser API enabling immersive VR and AR experiences, exposing hardware device inputs and scene-graph navigation to web content. The vulnerable component failed to apply sufficient validation to untrusted input presented through this API pathway, classified under CWE-20 (Improper Input Validation). The affected CPE scope is Google Chrome on desktop prior to version 150.0.7871.47 across all supported platforms. Because WebXR is a relatively niche browser API surface, exploitation requires a page that specifically exercises WebXR input handling in a way that triggers the validation gap.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, which is confirmed as the patched release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this update automatically on most managed and consumer installations - administrators should verify fleet update compliance via Chrome Browser Cloud Management or equivalent MDM tooling. If immediate patching is not feasible, a targeted workaround is to disable or restrict WebXR access via enterprise policy (Chrome's WebXR-related policies such as blocking camera/motion sensor permissions reduce the attack surface); note that this will break any legitimate WebXR applications in the environment. No other compensating controls directly address the underlying input validation flaw.