What is the CVSS score of CVE-2026-14008?

CVE-2026-14008 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14008?

Yes, a patch is available for CVE-2026-14008. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14008

EUVD-2026-40696 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-5v6g-3342-xc2g

Information Disclosure Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N, AC:L), no authentication needed (PR:N), active visit required (UI:R), process memory exposed at high severity (C:H), no write or DoS impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:36 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Google Chrome's WebXR subsystem on Android (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive contents from process memory by inducing a victim to visit a crafted HTML page. The root cause is CWE-457 (use of an uninitialized variable) within the WebXR implementation, meaning memory buffers are consumed before being properly zeroed or assigned, exposing whatever residual data the process held. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page with WebXR payload

Delivery

Victim clicks link on Android Chrome

Exploit

Browser initializes WebXR session, reads uninitialized buffer

Execution

Process memory contents exposed to JavaScript context

Impact

Attacker exfiltrates leaked memory data

Access

Attacker crafts malicious HTML page with WebXR payload

Delivery

Victim clicks link on Android Chrome

Exploit

Browser initializes WebXR session, reads uninitialized buffer

Execution

Process memory contents exposed to JavaScript context

Impact

Attacker exfiltrates leaked memory data

Vulnerability AssessmentAI

Exploitation	The victim must be using Google Chrome on Android (not desktop or iOS) running a version strictly below 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N captures the core risk profile accurately: the attack is network-delivered and low-complexity, requiring no authentication, but does demand active user interaction (UI:R) - the victim must navigate to a crafted page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing malicious WebXR session code designed to trigger an uninitialized buffer read in Chrome's Android WebXR implementation. When an Android Chrome user visits the page - for instance, via a phishing link, malvertising, or a compromised site - the uninitialized memory contents are surfaced to the attacker-controlled JavaScript context and can be exfiltrated. …
Remediation	Update Google Chrome on Android to version 150.0.7871.47 or later. … Detailed patch versions, workarounds, and compensating controls in full report.