What is the CVSS score of CVE-2026-14017?

CVE-2026-14017 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14017?

Google Chrome versions before 150.0.7871.47 contain a critical sandbox escape vulnerability that could escalate browser compromise into system-level access for millions of users.. A patch is available.

How to fix or mitigate CVE-2026-14017?

24 hours: Begin testing Chrome 150.0.7871.47 patch and assess auto-update mechanisms or managed rollout capabilities. 7 days: Deploy patch to pilot cohort (10% of users), validate application compatibility. 30 days: Complete deployment of Chrome 150.0.7871.47 or later to all Chrome instances.

Google Chrome CVE-2026-14017

EUVD-2026-40705 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-6w32-jgxr-c8j8

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Requires a pre-existing renderer compromise (PR:H) and reliable chaining plus user interaction (AC:H, UI:R); sandbox escape changes scope (S:C) exposing browser-process data (C:H/I:H), with no clear availability impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:24 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Navigation component before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Medium by Chromium but carries a 9.6 CVSS due to the scope-changing sandbox breach; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis, indicating it is realistically a second-stage link in an exploit chain rather than a standalone remote-code path.

Technical ContextAI

The flaw lives in Chromium's Navigation logic, which governs how the browser transitions between documents, sites, and processes and enforces the site-isolation boundary between the sandboxed renderer and the more-privileged browser process. CWE-693 (Protection Mechanism Failure) is the root-cause class: an inappropriate implementation causes a security control - here the renderer sandbox / navigation isolation - to fail to fully contain a malicious renderer, allowing the confidentiality/integrity boundary to be crossed. Chromium ships in Chrome, Edge, Brave, Opera, Electron apps, and Android WebView, so the underlying navigation code has extremely broad reach even though this CVE is filed against Google Chrome. Google's tags associate it with Information Disclosure, consistent with a sandbox escape exposing browser-process-held data.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 150.0.7871.47 or later on all desktop platforms; verify via chrome://settings/help and relaunch to apply, as documented in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Users of Chromium-based browsers should install the equivalent vendor build once published. No standalone workaround fully substitutes for the patch, but because exploitation requires a compromised renderer first, compensating controls that reduce renderer compromise help: keep the browser and all extensions current, enforce Enhanced Safe Browsing, and consider enabling the site-isolation / strict-origin-isolation enterprise policies (already default) - the trade-off is minor memory overhead. For high-risk environments, restricting untrusted web content or deploying browser isolation reduces the chance an attacker lands the prerequisite renderer bug, at the cost of user friction.