What is the CVSS score of EUVD-2026-40840?

EUVD-2026-40840 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-40840?

Yes, a patch is available for EUVD-2026-40840. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-40840

| CVE-2026-14153 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-30 chrome-cve-admin@google.com

GHSA-w785-mvh3-x6r4

Information Disclosure Google Red Hat Suse

5.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-delivered via crafted page (AV:N); specific user gestures required raise complexity (AC:H, UI:R); spoofed UI can elicit credential disclosure (C:H); no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:45 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Glic is a Chrome-internal component associated with Google's AI-assisted browser overlay features. The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), a class of flaw where an application renders UI elements in a way that deceives the user about the true nature, origin, or trustworthiness of content. In this case, an 'inappropriate implementation' in Glic allows a crafted HTML page to hijack or mimic trusted browser chrome - such as address bar indicators, permission dialogs, or origin badges - when the user performs specific gesture sequences. This class of vulnerability is particularly dangerous in browsers because users rely on consistent UI signals (padlocks, origin labels, permission prompts) to make security-critical trust decisions. Affected CPE inferred from EUVD: Google Chrome versions below 150.0.7871.47 on desktop platforms.

RemediationAI

The primary fix is to update Google Chrome to version 150.0.7871.47 or later, which was released via the stable channel and confirmed in the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates in most enterprise and consumer deployments, but administrators should verify endpoint compliance via fleet management tools. No workaround is documented by the vendor for environments that cannot immediately update. As a compensating control, organizations can restrict access to untrusted external web content via proxy filtering, reducing the attack surface - though this does not eliminate the vulnerability and carries operational trade-offs for general browsing use. Disabling or restricting the Glic AI overlay feature via Chrome enterprise policy (if supported) may reduce exposure to this specific component, but this has not been confirmed as a mitigation by Google.