What is the CVSS score of EUVD-2026-40766?

EUVD-2026-40766 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40766?

Yes, a patch is available for EUVD-2026-40766. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40766

| CVE-2026-14079 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-jw8m-g45f-3fgv

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Remote delivery via crafted page requires user visit (UI:R); integrity-only impact as SOP bypass enables cross-origin writes, not confirmed reads; no privilege escalation or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:36 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's Network component (versions prior to 150.0.7871.47) allows a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to a victim. The flaw, rooted in CWE-346 (Origin Validation Error), enables unauthorized cross-origin integrity impacts - an attacker can cause a browser to act on or submit data across origin boundaries it should enforce. With an EPSS of 0.18% at the 8th percentile, no CISA KEV listing, and no public exploit identified, active exploitation risk is low at this time, though Chrome's ubiquitous deployment ensures broad attack surface if exploitation techniques mature.

Technical ContextAI

The vulnerability lies in Chrome's Network layer, which is responsible for enforcing browser security policies including the Same-Origin Policy (SOP) and Cross-Origin Resource Sharing (CORS) rules. CWE-346 (Origin Validation Error) describes failures where the software does not properly verify that a request or data originates from a trusted source, allowing cross-origin policy boundaries to be circumvented. In Chromium's architecture, the Network Service is a sandboxed process handling HTTP(S) requests; insufficient policy enforcement here can allow crafted pages to trigger cross-origin requests or responses that would normally be blocked. Affected CPE covers Google Chrome on all platforms running versions below 150.0.7871.47, as documented by EUVD-2026-40766 and confirmed in the Chrome stable channel release notes.

RemediationAI

The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, available via Chrome's built-in update mechanism or the stable channel release page at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No workaround is documented in the available references. Organizations unable to immediately patch can reduce exposure by enforcing enterprise browser management policies that restrict navigation to untrusted or unsolicited external URLs, using proxy filtering to block access to known-malicious domains, and enabling Chrome's Enhanced Safe Browsing mode. Note that these mitigations reduce, but do not eliminate, risk from socially engineered phishing delivery. Patch deployment is the only confirmed remediation.