What is the CVSS score of EUVD-2026-40824?

EUVD-2026-40824 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40824?

Yes, a patch is available for EUVD-2026-40824. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-40824

| CVE-2026-14137 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-crvr-3r6g-3g4x

Information Disclosure Google Apple Red Hat Suse

4.2

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

3.1 LOW

UI spoofing via specific gestures warrants AC:H and UI:R; no confidentiality or availability impact is supported by the description - A:L from NVD is not justified.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:43 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.2

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.

Technical ContextAI

The vulnerability exists in the Chrome for iOS browser - Google's Chromium-based browser adapted for Apple's iOS platform - and is classified under CWE-20 (Improper Input Validation). Unlike desktop Chrome, Chrome for iOS uses Apple's WebKit rendering engine under the hood due to App Store constraints, but applies its own UI chrome and gesture-handling layers on top. The insufficient validation in this context likely occurs in Chrome's iOS-specific UI gesture processing or address-bar/overlay rendering code, where crafted HTML content can influence browser-level UI elements in a way not intended by the browser's trust model. The affected version range is any Chrome for iOS release prior to 150.0.7871.47, as confirmed by the EUVD affected version entry 'Chrome 150.0.7871.47 <150.0.7871.47'.

RemediationAI

Update Google Chrome for iOS to version 150.0.7871.47 or later; this is the vendor-released patch as confirmed by the Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html (note the URL references 'desktop' but covers the broader stable channel release). The fix can be applied through the Apple App Store by updating Chrome for iOS. No workaround is required given patch availability, but as an interim measure on managed devices, administrators could restrict or disable Chrome for iOS via Mobile Device Management (MDM) policy and enforce use of an alternative browser - though this carries significant usability trade-offs. Given the Low severity and the requirement for user interaction with specific gestures, the urgency for workarounds is minimal.