What is the CVSS score of CVE-2026-14001?

CVE-2026-14001 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14001?

Yes, a patch is available for CVE-2026-14001. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14001

EUVD-2026-40689 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 chrome-cve-admin@google.com

GHSA-g33c-4gx6-v8xr

XSS Google Red Hat

6.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network delivery requires user interaction (UI:R); Changed scope reflects cross-origin script execution capability; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

8.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:25 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by tricking a user into visiting a crafted HTML page. Unlike application-level XSS, this browser-level flaw can bypass the Same-Origin Policy, potentially allowing injected scripts to interact with content from origins other than the attacker's page. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at a low 0.17% (7th percentile); a vendor-released patch is available.

Technical ContextAI

CWE-79 (Cross-site Scripting) manifests here as a UXSS - a class of flaw residing in the browser's own implementation rather than a web application, making it far more impactful than conventional XSS because it can violate the Same-Origin Policy globally. The root cause is an 'inappropriate implementation' in Chrome's Network component, meaning the browser mishandles a particular network-level interaction when rendering a crafted HTML page in a way that permits script injection across origins. The affected product is Google Chrome all versions prior to 150.0.7871.47 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The CVSS Changed scope (S:C) directly reflects UXSS semantics: the exploited component (the browser's network layer) can affect resources beyond the origin of the attacking page.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this for most desktop users, but enterprise environments managing Chrome via policy should verify deployment through their endpoint management tooling. SUSE users should monitor SUSE Security Advisories for a corresponding Chromium package update, as the intelligence tags suggest downstream impact; no exact SUSE fix version is confirmed from available data. If patching cannot be applied immediately, enforcing web filtering or proxy policies that block access to untrusted or unknown external URLs reduces the likelihood of users visiting a crafted page - this is an imperfect control with usability trade-offs and does not address the underlying flaw. Server-side Content Security Policy headers on internally-controlled properties cannot mitigate a browser-level UXSS and should not be relied upon as a compensating control for this issue.