What is the CVSS score of EUVD-2026-40792?

EUVD-2026-40792 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by EUVD-2026-40792?

Google Chrome's Speech component contains a Same-Origin-Policy bypass (CVE-2026-14105) affecting all desktop versions before 150.0.7871.47 that allows remote attackers to cross security boundaries if…. A patch is available.

How to fix or mitigate EUVD-2026-40792?

Within 24 hours: Audit deployed Chrome versions across endpoints to identify builds earlier than 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later organization-wide via group policy, MDM, or managed update mechanisms. Within 30 days: Confirm 100% deployment completion and verify auto-update policies are enforced.

Google EUVD-2026-40792

| CVE-2026-14105 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-px6h-ffrr-9w49

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 4.3 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 02, 2026 - 14:52 NVD

CRITICAL MEDIUM

CVSS changed

Jul 02, 2026 - 14:52 NVD

9.6 (CRITICAL) 4.3 (MEDIUM)

Analysis Generated

Jul 01, 2026 - 17:25 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionNVD

Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin-policy bypass in Google Chrome's Speech component before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page cross origin boundaries via insufficient policy enforcement. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile); notably, Google's own Chromium team rated this Low severity even though NVD scored it CVSS 9.6, a significant conflict defenders should weigh. Requires user interaction (visiting the page) and affects all Chrome desktop builds prior to the fixed stable release.