What is the CVSS score of CVE-2026-14038?

CVE-2026-14038 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14038?

Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-14038) affecting versions prior to 150.0.7871.47 that could allow attackers with renderer process access to bypass security…. A patch is available.

How to fix or mitigate CVE-2026-14038?

Within 24 hours: Inventory all Chrome deployments across the organization and identify systems with administrative access or internet-facing exposure. Within 7 days: Deploy Chrome 150.0.7871.47 or later organization-wide using managed update channels; enable automatic updates where governance allows. Within 30 days: Complete deployment verification across all endpoints; audit for any remaining vulnerable versions; implement logging on renderer process anomalies.

Google Chrome CVE-2026-14038

EUVD-2026-40725 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-hwh2-jx98-3hx9

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.3 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Requires a pre-compromised renderer (PR:H) and successful exploit chaining (AC:H); sandbox escape crosses into the browser process (S:C) yielding high confidentiality/integrity impact but no availability effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

CRITICAL

qualitative

Red Hat

2.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:28 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

9.3 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's New Tab Page prior to 150.0.7871.47 allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) and requires a pre-existing renderer foothold, making it a second-stage exploit rather than an initial-access vector. Google rated the Chromium severity as Low; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile).

Technical ContextAI

The vulnerability lives in Chrome's New Tab Page (NTP), a privileged WebUI surface rendered inside the browser that bridges renderer-supplied content and browser-process capabilities. Chromium's security model isolates untrusted web content in a sandboxed renderer process; a sandbox escape means code running in that low-privilege renderer gains access to the higher-privilege browser process. The root cause is CWE-20 (Improper Input Validation): the NTP fails to sufficiently validate untrusted input crossing the renderer/browser trust boundary, which an attacker controlling the renderer can abuse. The affected component is the Chrome desktop stable channel (CPE would map to cpe:2.3:a:google:chrome:*) on all supported desktop platforms below 150.0.7871.47.

RemediationAI

Upgrade to the primary fix, Vendor-released patch: Google Chrome 150.0.7871.47 or later, via the stable desktop channel; Chrome's auto-update will deliver this, but administrators should force-relaunch to apply it since a running browser is not protected until restarted, and Chromium-based downstream browsers (Edge, Brave, etc.) should be updated once their vendors ship the merged fix. As a compensating control until patching, restrict exposure to renderer-compromise exploits by enforcing Site Isolation (default), keeping the renderer sandbox enabled, and deploying enterprise policies to limit untrusted content; because this bug requires a pre-compromised renderer, promptly patching any renderer-level RCE bugs in the same release is the more effective mitigation. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) for the full set of fixes in this build.