What is the CVSS score of CVE-2026-14037?

CVE-2026-14037 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14037?

Google Chrome versions before 150.0.7871.47 contain a CRITICAL sandbox escape (CVSS 9.6) that enables privilege escalation once an attacker compromises the renderer process; while the 0.2% EPSS and…. A patch is available.

How to fix or mitigate CVE-2026-14037?

Within 24 hours: Test Chrome 150.0.7871.47 in isolated environment; notify IT and end users of mandatory security update. Within 7 days: Deploy Chrome 150.0.7871.47 across all managed systems using automated deployment tools; verify version compliance. Within 30 days: Confirm auto-update policies are enabled organization-wide; audit any offline/restricted systems for manual patch application.

Google Chrome CVE-2026-14037

EUVD-2026-40724 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-6932-p8gp-f49x

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered over the web (AV:N, UI:R) but requires a pre-existing renderer compromise, so AC:H; sandbox escape crosses a trust boundary (S:C) yielding high host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:27 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's GPU process before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. The flaw is a protection-mechanism failure (CWE-693) that Google patched in the June 2026 Stable channel update; Chromium rated its intrinsic severity Low because it is only useful as the second link in an exploit chain, and no public exploit has been identified at time of analysis. EPSS probability is low (0.17%, 7th percentile), consistent with a chained bug rather than a mass-exploitable entry point.

Technical ContextAI

The vulnerability lives in Chrome's GPU process, which handles hardware-accelerated graphics (WebGL, WebGPU, compositing) and is a privileged component the renderer talks to over Chromium's Mojo IPC. Chrome's multi-process security model confines web content to a low-privilege, sandboxed renderer; the GPU process enforces policy on the commands and resources the renderer may request. CWE-693 (Protection Mechanism Failure) here means that policy enforcement in the GPU is insufficient, so a renderer that has been subverted can issue requests the sandbox boundary was supposed to reject, escalating out of the renderer sandbox. This is not a memory-corruption primitive by itself but a logic/enforcement gap that becomes valuable when combined with a prior renderer compromise (e.g., a V8 or DOM bug).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms, per Google's Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome normally auto-updates, so ensure the browser has been fully relaunched to apply the update and confirm the version via chrome://settings/help. There is no supported configuration workaround for the enforcement gap itself, but because exploitation requires a prior renderer compromise, defense-in-depth reduces exposure: enabling the Site Isolation and strict sandbox defaults (do not launch Chrome with --no-sandbox or --disable-gpu-sandbox, which would remove the boundary this bug targets), and in managed fleets disabling unnecessary hardware acceleration/WebGPU where GPU features are not needed can shrink the attack surface at the cost of graphics performance. Managed environments should push the update via enterprise policy rather than relying solely on per-user auto-update.