What is the CVSS score of EUVD-2026-40832?

EUVD-2026-40832 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40832?

Yes, a patch is available for EUVD-2026-40832. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40832

| CVE-2026-14145 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 chrome-cve-admin@google.com

GHSA-j8j5-4jrx-pv6x

XSS Google Red Hat Suse

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered UXSS requiring active user navigation (UI:R); scope changed due to potential SOP bypass; C:L and I:L reflect partial cross-origin data access with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:46 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.1 (None) 6.1 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically an inappropriate implementation within Chrome's CSS parsing or rendering subsystem. The UXSS classification is technically distinct from ordinary reflected or stored XSS: rather than being constrained to a single origin, a browser-level UXSS can allow injected scripts to operate across the Same-Origin Policy boundary, potentially reading or modifying data from other origins currently loaded in the victim's browser session. This cross-origin impact is confirmed by the S:C (Scope Changed) metric in the CVSS 3.1 vector. The flaw was reported through chrome-cve-admin@google.com and tracked in Chromium issue tracker (issues.chromium.org/issues/514485825). Affected product: Google Chrome desktop, all versions prior to 150.0.7871.47, as confirmed by EUVD-2026-40832.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, as documented in the stable channel release at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; restarting the browser after the update is downloaded completes the installation. Enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify fleet-wide deployment of 150.0.7871.47+ and confirm via policy reporting. No vendor-published workarounds are available for this specific flaw. If immediate patching is operationally blocked, a partial compensating control is to enforce Safe Browsing at the enterprise level and restrict navigation to untrusted external sites, though this imposes browsing restrictions and does not eliminate risk from compromised or malicious-but-plausible-looking sites.