What is the CVSS score of CVE-2026-14034?

CVE-2026-14034 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14034?

Yes, a patch is available for CVE-2026-14034. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14034

EUVD-2026-40721 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-jwv3-663x-vrw4

Authentication Bypass Google Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

AV:N for remotely served page; UI:R for required victim interaction; I:L for navigation bypass only; no C or A impact; S:U as no scope change occurs.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:31 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

WebXR implementation flaw in Google Chrome on Android prior to 150.0.7871.47 permits remote attackers to bypass navigation restrictions by delivering a crafted HTML page to a victim. The vulnerability is Android-specific and requires user interaction to trigger, constraining its reach. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page exploiting WebXR API

Delivery

Victim opens page in Chrome on unpatched Android device

Exploit

User interaction triggers vulnerable WebXR navigation code path

Execution

Navigation access controls improperly enforced

Impact

Attacker-controlled navigation target executed in browser

Access

Attacker crafts malicious HTML page exploiting WebXR API

Delivery

Victim opens page in Chrome on unpatched Android device

Exploit

User interaction triggers vulnerable WebXR navigation code path

Execution

Navigation access controls improperly enforced

Impact

Attacker-controlled navigation target executed in browser

Vulnerability AssessmentAI

Exploitation	Exploitation is limited to Google Chrome on Android - desktop Chrome and other browsers are not affected per the CVE description. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores 4.3 (Medium), reflecting a network-reachable, low-complexity attack requiring no privileges but mandating user interaction, with a limited integrity-only impact and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page that invokes Chrome's WebXR API on Android in an unexpected way to trigger the improper access control path. When a victim on an unpatched Android device visits the page and interacts with it, the browser's navigation restrictions are bypassed, potentially allowing the attacker to redirect the browser to unintended origins or manipulate navigation state outside of permitted bounds. …
Remediation	Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in update mechanism; this is the vendor-confirmed fix as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.