What is the CVSS score of CVE-2026-14007?

CVE-2026-14007 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14007?

Yes, a patch is available for CVE-2026-14007. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14007

EUVD-2026-40695 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-c6cq-7fvc-v2jc

Authentication Bypass Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML requiring active user visit; no privileges needed; integrity bypass is high but no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:23 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient PermissionsPolicy enforcement in Google Chrome prior to 150.0.7871.47 enables remote attackers to bypass navigation restrictions by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H) because an attacker can circumvent declarative browser navigation controls, potentially redirecting victims to unintended origins or overriding policy-enforced browsing constraints. No public exploit code exists and SSVC signals exploitation as none, placing this in a lower-priority patch tier despite the medium-high CVSS score.

Technical ContextAI

Google Chrome's Permissions Policy (formerly Feature Policy, CWE-602: Client-Side Enforcement of Server-Side Security) is a web platform mechanism allowing servers to declare which browser capabilities - camera, geolocation, navigation delegation - are permitted in a document and its sub-frames. CWE-602 describes the root cause class: security logic that should be enforced server-side or in a trusted context is instead enforced client-side and can be bypassed by a malicious actor controlling the client-side input. In this case, Chrome's PermissionsPolicy evaluation is insufficiently strict, allowing a specially crafted HTML page to supply policy directives or frame structures that the browser incorrectly validates, thereby bypassing navigation restrictions that a legitimate site or its headers intended to enforce. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all platforms (Windows, macOS, Linux, ChromeOS) running Chrome versions below 150.0.7871.47.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in updater (chrome://settings/help) or organizational software deployment tooling. The vendor advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments where immediate browser updates are not possible, administrators can restrict access to untrusted external web content via network-level URL filtering or proxy controls to reduce exposure to crafted HTML pages; however, this has operational trade-offs for users requiring general web access. Organizations using SUSE Linux-packaged Chromium should monitor SUSE security advisories for a downstream-patched package. No workaround fully substitutes for the upstream patch since the flaw is in Chrome's internal PermissionsPolicy evaluation logic.