What is the CVSS score of EUVD-2026-74371?

EUVD-2026-74371 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-74371?

Yes, a patch is available for EUVD-2026-74371. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-74371

| CVE-2026-87649 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-09-09 Chrome

GHSA-r6j3-94mg-3wrx

Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network delivery via crafted HTML, no auth needed, mandatory user interaction for download approval, and low-scope C/I impact from restriction bypass.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 14:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 10, 2026 - 14:21 vuln.today

CVSS changed

Sep 10, 2026 - 14:07 NVD

5.4 (MEDIUM)

Patch available

Sep 09, 2026 - 01:03 EUVD

CVE Published

Sep 09, 2026 - 00:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 09, 2026 - 00:09 nvd

MEDIUM 5.4

DescriptionNVD

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a user visit or be directed to a crafted HTML page controlled by the attacker (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate despite a CVSS 5.4 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Google Chrome to version 153.0.8010.36 or later, which is confirmed as the vendor-released patch per the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report.