What is the CVSS score of CVE-2026-14015?

CVE-2026-14015 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14015?

Yes, a patch is available for CVE-2026-14015. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14015

EUVD-2026-40703 MEDIUM

Race Condition (CWE-362)

2026-06-30 chrome-cve-admin@google.com

GHSA-x63f-3c5p-f7p4

Information Disclosure Google Race Condition Microsoft Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Race condition (CWE-362) requires winning a timing window, warranting AC:H over the vendor-assigned AC:L; all other metrics reflect unauthenticated, user-interaction-required cross-origin disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:44 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) signals low near-term exploitation probability despite the CVSS High confidentiality impact - consistent with Chromium's own 'Medium' severity designation and the inherent timing-sensitivity of race condition attacks.

Technical ContextAI

The vulnerability lies in Chrome's WebRTC (Web Real-Time Communication) implementation - a browser subsystem providing peer-to-peer audio, video, and data channels via JavaScript APIs. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause as a race condition: two or more concurrent threads or asynchronous operations compete over shared WebRTC state without adequate synchronization, creating a window where cross-origin data can be accessed before the browser's Same-Origin Policy enforcement is fully applied. The Windows-only scope (stated explicitly in the CVE description) suggests a platform-specific threading or IPC model difference in Chrome's process architecture on Windows. The EUVD entry EUVD-2026-40703 confirms the affected version range as all Chrome releases below 150.0.7871.47. No CPE strings were provided in the intelligence feed.

RemediationAI

Update Google Chrome on Windows to version 150.0.7871.47 or later immediately; this is the vendor-released patch confirmed in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In enterprise environments, deploy the update via Google Update, Chrome Browser Cloud Management, or group policy. For managed fleets where immediate patching is constrained, disabling WebRTC via Chrome enterprise policy (setting WebRtcAllowed to false) eliminates the vulnerable attack surface, but will break web-based video conferencing, VoIP, and any WebRTC-dependent business applications - assess operational impact before applying. Web content filtering to block navigation to untrusted external sites reduces exposure by preventing victims from reaching attacker-controlled pages, though this is not a substitute for patching.