What is the CVSS score of EUVD-2026-40765?

EUVD-2026-40765 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40765?

Google Chrome users organization-wide face privilege escalation risk (CVE-2026-14078) when visiting malicious websites; successful exploitation could result in system compromise and unauthorized data…. A patch is available.

How to fix or mitigate EUVD-2026-40765?

24 hours: Verify Chrome 150.0.7871.47 patch compatibility with enterprise applications in a test environment. 7 days: Deploy Chrome 150.0.7871.47 to all endpoints via MDM/software distribution; prioritize user-facing workstations and employees with access to sensitive data. 30 days: Confirm 95%+ deployment completion and monitor for any anomalous WebRTC activity.

Google Chrome EUVD-2026-40765

| CVE-2026-14078 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-j4g3-hmm7-q437

Privilege Escalation Google Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page requiring the victim to visit it (UI:R), no auth (PR:N), low complexity, with high impact consistent with in-browser privilege escalation; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:35 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's WebRTC component (versions prior to 150.0.7871.47) allows a remote attacker to escape normal renderer restrictions when a victim opens a crafted HTML page, per the CVSS vector achieving high confidentiality, integrity, and availability impact. Exploitation requires user interaction (visiting a malicious page) but no prior authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile); notably, Google/Chromium rated this 'Low' severity while the NVD CVSS is 8.8 (High), a discrepancy defenders should weigh.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that enables peer-to-peer audio, video, and data channels directly from JavaScript/HTML without plugins; it parses complex, attacker-influenceable session and media data. The root cause is classified as CWE-20 (Improper Input Validation): insufficient validation of untrusted input within Chrome's WebRTC implementation. Because WebRTC handling spans the sandboxed renderer and privileged browser processes, an input-validation defect here can be leveraged to cross a trust boundary - the reported effect is privilege escalation rather than pure information disclosure. The affected code path ships in the Chromium engine underlying Chrome and Chromium-derived browsers.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; on most installs this arrives automatically, so trigger it by opening chrome://settings/help and relaunching the browser to force the update to complete. Enterprises should push the update through their managed-browser tooling and confirm the version post-restart. Users of Chromium-based browsers should apply the corresponding vendor update once it incorporates the patched Chromium. Because the attack requires opening a crafted page, interim compensating controls include restricting or disabling WebRTC where it is not needed (via enterprise policy or extensions - trade-off: breaks video conferencing and other real-time features) and enforcing web filtering to block untrusted sites; these are stopgaps only, as prompt patching is the definitive fix. See the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.