What is the CVSS score of CVE-2026-14032?

CVE-2026-14032 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-14032?

Google Chrome on macOS (versions prior to 150.0.7871.47) contains a use-after-free vulnerability in the Bluetooth component that allows arbitrary code execution through malicious browser extensions,…. A patch is available.

How to fix or mitigate CVE-2026-14032?

Within 24 hours, notify all macOS users running Chrome to immediately update to version 150.0.7871.47 or later. Within 7 days, implement or reinforce policies restricting Chrome extension installation to organization-approved sources and conduct an audit of currently installed extensions to identify and remove suspicious ones. Within 30 days, enforce automatic Chrome updates organization-wide and deploy endpoint monitoring to detect unusual extension installation patterns or unauthorized extension activity in enterprise environments.

Google CVE-2026-14032

EUVD-2026-40719 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-p24m-96hg-m8m8

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.1 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:22 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.1

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, triggerable by a crafted Chrome Extension. An attacker who convinces a user to install a malicious extension can corrupt memory to run code in the browser context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.13% (3rd percentile), and CISA SSVC records exploitation status as none.