What is the CVSS score of EUVD-2026-40817?

EUVD-2026-40817 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40817?

Yes, a patch is available for EUVD-2026-40817. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40817

| CVE-2026-14130 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-crcp-w54f-c64v

Information Disclosure Google Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered spoofing requires active user navigation (UI:R); no attacker auth needed; impact is integrity-only (misleading Omnibox display) with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:37 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionNVD

Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker registers lookalike or crafted domain

Delivery

Hosts malicious HTML page exploiting Omnibox rendering flaw

Exploit

Victim navigates to attacker URL

Execution

Chrome displays spoofed origin in address bar

Persist

Victim trusts false security indicator

Impact

Victim submits credentials or sensitive data to attacker

Access

Attacker registers lookalike or crafted domain

Delivery

Hosts malicious HTML page exploiting Omnibox rendering flaw

Exploit

Victim navigates to attacker URL

Execution

Chrome displays spoofed origin in address bar

Persist

Victim trusts false security indicator

Impact

Victim submits credentials or sensitive data to attacker

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome for desktop at a version prior to 150.0.7871.47 and must actively navigate to a crafted HTML page controlled by the attacker - the CVSS UI:R metric confirms this mandatory user interaction step. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N yields a score of 4.3, reflecting that while exploitation is network-accessible with low complexity and no attacker privileges, user interaction is mandatory and impact is bounded to low integrity - no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a lookalike domain and hosts a crafted HTML page that manipulates Chrome's Omnibox display to render a trusted origin (such as a financial institution or identity provider) while the browser context is actually attacker-controlled. A victim who navigates to the attacker's page observes the falsified address bar indicator and proceeds to submit credentials or authorize sensitive actions. …
Remediation	Update Google Chrome to version 150.0.7871.47 or later - this is the vendor-confirmed fix per the Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.