What is the CVSS score of EUVD-2026-40792?

EUVD-2026-40792 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by EUVD-2026-40792?

Google Chrome's Speech component contains a Same-Origin-Policy bypass (CVE-2026-14105) affecting all desktop versions before 150.0.7871.47 that allows remote attackers to cross security boundaries if…. A patch is available.

How to fix or mitigate EUVD-2026-40792?

Within 24 hours: Audit deployed Chrome versions across endpoints to identify builds earlier than 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later organization-wide via group policy, MDM, or managed update mechanisms. Within 30 days: Confirm 100% deployment completion and verify auto-update policies are enforced.

Google EUVD-2026-40792

| CVE-2026-14105 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-px6h-ffrr-9w49

Authentication Bypass Google Suse

Medium

Disputed · 4.3 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 02, 2026 - 14:52 NVD

CRITICAL MEDIUM

CVSS changed

Jul 02, 2026 - 14:52 NVD

9.6 (CRITICAL) 4.3 (MEDIUM)

Analysis Generated

Jul 01, 2026 - 17:25 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionNVD

Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin-policy bypass in Google Chrome's Speech component before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page cross origin boundaries via insufficient policy enforcement. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile); notably, Google's own Chromium team rated this Low severity even though NVD scored it CVSS 9.6, a significant conflict defenders should weigh. …