What is the CVSS score of CVE-2026-14004?

CVE-2026-14004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14004?

Yes, a patch is available for CVE-2026-14004. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14004

EUVD-2026-40692 MEDIUM

Information Exposure (CWE-200)

2026-06-30 chrome-cve-admin@google.com

GHSA-987x-rgv4-wfmq

Information Disclosure Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page with mandatory user interaction (UI:R); no auth required; cross-origin data leakage yields C:H with zero integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:24 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 is exploitable by a remote, unauthenticated attacker who tricks a user into visiting a crafted HTML page that abuses an inappropriate CSS implementation to bypass same-origin policy protections. The confidentiality impact is rated high (C:H) because sensitive data from cross-origin resources - such as page content or authentication artifacts readable via CSS side-channels - can be exposed to the attacker-controlled page. No public exploit or active exploitation has been identified; EPSS stands at 0.21% (11th percentile) and SSVC corroborates with exploitation: none and automatable: no.

Technical ContextAI

The vulnerability resides in Chrome's CSS rendering engine and is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). CSS-based cross-origin information leaks typically arise from timing side-channels, speculative rendering, or improper handling of cross-origin resource properties that become observable through CSS properties or computed styles - violating the browser's same-origin policy. The affected product is Google Chrome across all versions prior to 150.0.7871.47, as confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the EUVD affected version range 'Chrome 150.0.7871.47 <150.0.7871.47'. The Chromium issue tracker entry (issues.chromium.org/issues/514538751) may contain additional technical detail but access is not confirmed from available data.

RemediationAI

The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor's stable channel release advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism handles this for most desktop deployments; enterprise administrators should verify update policies via Google Admin Console or MDM to ensure fleet-wide rollout. For SUSE-based Linux deployments, apply the corresponding distribution security update once released by the SUSE security team. There are no documented workarounds for this CSS implementation flaw; disabling JavaScript would reduce attack surface but cause severe application breakage and is not a practical compensating control. Organizations with strict browsing policies restricting navigation to untrusted external HTML pages would reduce exposure as a secondary control.