What is the CVSS score of CVE-2026-14036?

CVE-2026-14036 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14036?

Google Chrome versions prior to 150.0.7871.47 contain a privilege escalation vulnerability in the Bluetooth subsystem that could allow attackers to bypass browser security controls if users visit a…. A patch is available.

How to fix or mitigate CVE-2026-14036?

Within 24 hours: Audit Chrome version distribution across the organization to identify systems running versions prior to 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later to high-risk user populations (executives, engineers, users with sensitive data access). Within 30 days: Complete rollout to all Chrome installations and verify compliance through MDM or browser telemetry.

Google Chrome CVE-2026-14036

EUVD-2026-40723 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-jvh2-c5pp-79jm

Privilege Escalation Google Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Requires visiting a crafted page (UI:R) with no auth (PR:N); a Bluetooth policy bypass the vendor rates 'Low' implies limited confidentiality and integrity impact, not high-tier C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:33 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Bluetooth subsystem, letting a remote attacker who lures a victim to a crafted HTML page cross a security boundary the browser is supposed to guard. Google's Chrome release channel and the NVD-assigned CVSS 3.1 base score of 8.8 (High) diverge from Chromium's own internal 'Low' severity rating, signaling the practical impact is likely narrower than the raw score implies. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.17% (7th percentile), consistent with no active exploitation reported.

Technical ContextAI

The flaw lives in Chrome's implementation of the Web Bluetooth API / Bluetooth policy layer, the component that governs which origins may discover, pair with, and communicate with nearby Bluetooth devices and how enterprise or browser policy restrictions are applied to those actions. The assigned weakness, CWE-602 (Client-Side Enforcement of Server-Side Security), indicates the root cause is a trust or policy check enforced in a location an attacker can influence rather than authoritatively, so a malicious page can induce behavior the policy was meant to prohibit. Affected code is in the Chromium browser engine shipped in Google Chrome for desktop; because Chromium is the upstream base for many browsers (Edge, Brave, Opera) and Electron apps, downstream products built on the same engine version may share the defect until they rebase.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; this is delivered automatically through Chrome's built-in updater, so verify auto-update is enabled and relaunch to apply it (visiting chrome://settings/help forces the check). Managed fleets should push the update via Google Update or enterprise policy and confirm the installed build. See the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not possible, a targeted compensating control is to disable Web Bluetooth via enterprise policy (set DefaultWebBluetoothGuardSetting to block, or use WebBluetoothBlockedForUrls), which removes the attack surface entirely at the cost of breaking legitimate Bluetooth-enabled web apps; limiting users to trusted sites reduces but does not eliminate exposure since exploitation only requires opening a crafted page.