What is the CVSS score of CVE-2026-14023?

CVE-2026-14023 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14023?

Yes, a patch is available for CVE-2026-14023. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14023

EUVD-2026-40711 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-wrj4-qfvj-56qq

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N), low complexity (AC:L), no privileges needed (PR:N), victim must visit page (UI:R); impact is integrity-only SOP bypass (I:H), no confidentiality or availability impact, scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:45 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's SanitizerAPI before version 150.0.7871.47 allows a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page that exploits insufficient input validation. The flaw targets a security-critical browser API whose purpose is precisely to prevent unsafe HTML injection, making the bypass particularly notable. EPSS at 0.22% (13th percentile) indicates low near-term exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.

Technical ContextAI

The Sanitizer API is a W3C browser built-in interface designed to safely parse and strip dangerous constructs from arbitrary HTML strings, intended as a defense against XSS and related injection attacks. CWE-20 (Improper Input Validation) indicates the root cause is the API's failure to reject or neutralize certain crafted HTML constructs before outputting them, allowing content or attributes that violate the same-origin policy to survive sanitization. The same-origin policy (SOP) is a foundational browser security boundary that prevents scripts from one origin accessing resources from another; bypassing it can enable unauthorized cross-origin DOM interaction or data manipulation. The Chromium security team rated this Medium severity. No explicit CPE string was provided, but the affected component resides in the Chromium engine powering Chrome desktop builds prior to 150.0.7871.47 across Windows, macOS, and Linux.

RemediationAI

The primary fix is to update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism (Menu → Help → About Google Chrome) or through enterprise deployment tooling such as Google Admin Console or Microsoft Intune. The patch is documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments with auto-update disabled, administrators should prioritize pushing this update through policy management tools. As a compensating control prior to patching, restricting user access to untrusted external websites via web content filtering or browser isolation solutions (e.g., remote browser isolation) reduces exposure, though this impacts general browsing capability. No workaround that disables the SanitizerAPI specifically without breaking dependent web functionality has been confirmed by available data.