What is the CVSS score of EUVD-2026-40773?

EUVD-2026-40773 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40773?

A remote code execution vulnerability in Google Chrome (versions before 150.0.7871.47) could allow attackers to compromise user systems through malicious web pages, affecting any employee using an…. A patch is available.

How to fix or mitigate EUVD-2026-40773?

24 hours: Inventory Chrome browser versions across all endpoints to identify systems running versions prior to 150.0.7871.47. 7 days: Deploy Chrome 150.0.7871.47 or later via your browser management or automatic update channels to all affected systems. 30 days: Audit compliance and verify all systems have been updated; enforce automated updates for Chrome to prevent recurrence.

Google Chrome EUVD-2026-40773

| CVE-2026-14086 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-h34x-4c9f-4f6g

RCE Google Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); a successful HID RCE chain yields full C/I/A impact within the browser sandbox scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:35 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID component, letting a remote attacker who lures a victim to a crafted HTML page break out of intended HID access controls and run arbitrary code. Exploitation requires user interaction (visiting a malicious page) but no authentication, and no public exploit has been identified at time of analysis; EPSS is low at 0.21% (12th percentile). Notably, Google rates the Chromium security severity as 'Low' while the NVD-style CVSS is 8.8, a discrepancy worth weighing when prioritizing.

Technical ContextAI

The flaw lives in Chrome's WebHID (Human Interface Device) implementation, the browser API that lets web pages communicate with connected HID peripherals such as keyboards, gamepads, and specialized USB devices. CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: security policy that should gate HID access is enforced insufficiently or in a bypassable place, allowing a page to reach device or memory functionality it should not. Because Chromium underpins Chrome, Edge, Brave, Opera, and Electron apps, the same code path may affect the broader Chromium ecosystem, though only Google Chrome is named here with fix version 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the built-in updater (Help > About Google Chrome) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed environments, push the update through your endpoint management or enforce it via the RelaunchNotification and TargetVersionPrefix policies. As a compensating control until patched, disable WebHID exposure by setting the DefaultWebHidGuardSetting enterprise policy to block (value 2), which prevents pages from requesting HID device access - trade-off: legitimate web apps relying on HID hardware (security keys managed via HID, some conferencing or gaming peripherals) will stop working. Users of Chromium-based browsers should apply their vendor's corresponding Chromium refresh once available.