What is the CVSS score of CVE-2026-14025?

CVE-2026-14025 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14025?

Google Chrome on macOS running versions before 150.0.7871.47 is vulnerable to a rendering engine flaw allowing arbitrary code execution and potential data theft or malware installation when users…. A patch is available.

How to fix or mitigate CVE-2026-14025?

Within 24 hours: Inventory Chrome versions deployed on macOS systems and assess patch deployment readiness. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all macOS endpoints. Within 30 days: Verify patching completion across all macOS systems and implement automated browser update policies to prevent similar delays in future critical patches.

Google Chrome CVE-2026-14025

EUVD-2026-40713 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-4pvr-rcq6-xfr4

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via web page (AV:N) but requires specific UI gestures beyond a click, raising complexity (AC:H) and needing user interaction (UI:R); renderer compromise yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:32 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. EPSS is low at 0.21% (11th percentile), and the flaw is not in CISA KEV.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's 'Views' component - the cross-platform UI toolkit Chromium uses to build browser chrome and widgets (menus, dialogs, controls). A use-after-free occurs when memory is freed while a dangling pointer still references it; a subsequent access to that stale pointer can corrupt the heap and, if an attacker can shape the freed/reallocated memory, be steered toward controlled execution. Per the EUVD/NVD CPE scope, the affected product is Google Chrome on the Mac platform at versions below 150.0.7871.47; the bug is tracked internally at Chromium issue 506482786 and disclosed in the June 2026 Stable channel update.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome on macOS to 150.0.7871.47 or later via the Stable channel; most installs auto-update, so verify the version under chrome://settings/help and relaunch to apply. Reference Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-14025. Until the update is confirmed applied, reduce exposure by having users avoid untrusted web pages and by not interacting with unexpected UI prompts/gestures on unfamiliar sites, since exploitation depends on specific user interaction; enterprise fleets can enforce the minimum version through managed browser update policies (trade-off: forced relaunch may interrupt open sessions).