What is the CVSS score of EUVD-2026-40802?

EUVD-2026-40802 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-40802?

Google Chrome's Cast component prior to version 150.0.7871.47 contains a privilege escalation vulnerability that allows attackers to bypass renderer-level security boundaries.. A patch is available.

How to fix or mitigate EUVD-2026-40802?

Within 24 hours: Identify all Chrome deployments and current versions. Within 7 days: Deploy Chrome version 150.0.7871.47 or later across all managed systems. Within 30 days: Validate patch deployment completion and review security logs for any suspicious renderer process activity preceding the patch date.

Google Chrome EUVD-2026-40802

| CVE-2026-14115 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-3wq9-fwp9-c2mc

Privilege Escalation Google Red Hat Suse

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted page (AV:N) but requires prior renderer compromise plus timing (AC:H) and victim page load (UI:R); privilege escalation yields high C/I/A within the browser (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:37 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's Cast component before 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape renderer-level restrictions and gain higher privileges via a crafted HTML page. Rated Low severity by Chromium despite a 7.5 CVSS, it functions as a second-stage sandbox-escape primitive rather than a standalone initial-access bug. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), indicating minimal near-term mass-exploitation risk.

Technical ContextAI

The flaw sits in Chrome's Cast subsystem, the feature that discovers and streams tab/media content to Chromecast and other Google Cast receivers over the local network. The root cause is CWE-20 (Improper Input Validation): Cast insufficiently validates untrusted input crossing the renderer boundary, letting a hostile renderer supply data that the more-privileged browser process trusts. Because Chrome's multi-process architecture isolates untrusted web content in a sandboxed renderer, any bug that lets a compromised renderer influence a higher-privilege component is a privilege-escalation/sandbox-weakening primitive. Affected builds are all Chrome desktop versions prior to 150.0.7871.47 (EUVD range 'Chrome <150.0.7871.47').

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel and relaunch the browser to apply the fix (managed fleets should force-update through enterprise policy). Verify per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As an interim compensating control while patching, restrict or disable the Cast feature - for example via the enterprise policy that controls media routing / 'Cast' (EnableMediaRouter=Disabled), which removes the vulnerable code path's user exposure at the cost of losing local screen/tab casting to Chromecast devices. Network-level containment (limiting local-network access to Cast receivers) offers little benefit here since the trigger is a crafted HTML page in an already-compromised renderer, so prompt browser updating remains the only complete remediation.