What is the CVSS score of CVE-2026-14034?

CVE-2026-14034 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14034?

Yes, a patch is available for CVE-2026-14034. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14034

EUVD-2026-40721 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-jwv3-663x-vrw4

Authentication Bypass Google Red Hat Suse

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

AV:N for remotely served page; UI:R for required victim interaction; I:L for navigation bypass only; no C or A impact; S:U as no scope change occurs.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:31 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

WebXR implementation flaw in Google Chrome on Android prior to 150.0.7871.47 permits remote attackers to bypass navigation restrictions by delivering a crafted HTML page to a victim. The vulnerability is Android-specific and requires user interaction to trigger, constraining its reach. With no CISA KEV listing, no public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile), this represents a low-priority integrity issue that Google itself rates as Low severity.

Technical ContextAI

WebXR is the browser API providing access to augmented and virtual reality hardware and rendering contexts on the web. The root cause is CWE-284 (Improper Access Control), specifically an 'inappropriate implementation' in Chrome's WebXR subsystem on Android. This class of flaw indicates that the navigation restriction enforcement logic within the WebXR code path fails to apply or validate access controls correctly, allowing a crafted HTML page to circumvent intended same-origin or browser-level navigation boundaries. The flaw is scoped exclusively to Chrome on Android, suggesting a platform-specific code path divergence from the desktop implementation. No CPE strings were provided in the input data, but the EUVD confirms all Chrome for Android builds prior to 150.0.7871.47 as the affected range.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in update mechanism; this is the vendor-confirmed fix as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No vendor-documented workarounds exist for this specific issue. As an interim measure for environments with enterprise mobility management (EMM), restricting Chrome's ability to load arbitrary WebXR-capable content via managed browser policies could reduce exposure, though this trade-off would break legitimate AR/VR web experiences for end users. Given the low EPSS and absence of active exploitation, patching through the standard update cycle is appropriate for most organizations.