What is the CVSS score of CVE-2026-14041?

CVE-2026-14041 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14041?

Google Chrome before version 150.0.7871.47 contains a privilege escalation vulnerability that could allow attackers to escape browser protections and execute arbitrary code.. A patch is available.

How to fix or mitigate CVE-2026-14041?

Within 24 hours: Inventory Chrome installations across the organization and confirm current version numbers. Within 7 days: Test Chrome 150.0.7871.47 or later in a non-production environment and develop deployment plan. Within 30 days: Deploy Chrome 150.0.7871.47 or later to all affected endpoints.

Google Chrome CVE-2026-14041

EUVD-2026-40728 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-499r-fh8q-qcfc

Privilege Escalation Google Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Remote crafted page with required user interaction (UI:R), no auth (PR:N); impact lowered to C:L/I:L/A:N since a Serial policy-enforcement bypass is niche and Chromium rates it Low, not full-system CIA.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:33 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Serial (Web Serial API) component, allowing a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser. Note the signal conflict: NVD scores this 8.8 (High) with high confidentiality/integrity/availability impact, yet Chromium's own triage rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.17% (7th percentile).

Technical ContextAI

The flaw lives in Chrome's Serial subsystem, which implements the Web Serial API - a browser capability that lets web pages request access to local serial (COM/tty) ports after a user permission prompt. The root cause maps to CWE-602 (Client-Side Enforcement of Server-Side Security), a class of bug where a security decision or policy that should be strictly enforced is instead applied too loosely or on the wrong side of a trust boundary, letting a page bypass the intended permission/policy gate. In practice, insufficient policy enforcement in this component can let a page reach serial-related privileges it should not have, expanding the attack surface exposed to untrusted web content. Affected CPE-wise: Google Chrome desktop builds prior to 150.0.7871.47; the underlying Chromium engine means Chromium-derived browsers may share the code path.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 - upgrade to this Stable release or later, which for most users happens automatically via Chrome's background updater; confirm the version under Settings > About Google Chrome and relaunch to apply. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for the full stable-channel bulletin. In managed/enterprise fleets, push the update through your Chrome update policy or software distribution system and verify the reported version across endpoints. As an interim compensating control until updated, restrict the Web Serial API via enterprise policy (for example the DefaultSerialGuardSetting / SerialAskForUrls-style device policies) to block or gate serial-port access, which closes the exposed feature at the cost of breaking legitimate WebSerial-based tools (hardware programmers, some web-based device configurators). Chromium-based browsers should receive their vendor's equivalent update.