What is the CVSS score of CVE-2026-14044?

CVE-2026-14044 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14044?

Google Chrome versions prior to 150.0.7871.47 contain a critical vulnerability enabling privilege escalation and unauthorized access to user data following browser compromise.. A patch is available.

How to fix or mitigate CVE-2026-14044?

Within 24 hours: Assess Chrome deployment scope and communicate patch urgency to leadership. Within 7 days: Deploy Chrome version 150.0.7871.47 or later organization-wide through your endpoint management system (SCCM, Jamf, Google Workspace, or equivalent). Within 30 days: Verify deployment completion via device compliance reporting and confirm all systems are on version 150.0.7871.47 or later.

Google Chrome CVE-2026-14044

EUVD-2026-40731 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-g4xj-vxvq-mqxr

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-compromised renderer plus a crafted page; PR:N as no browser auth is needed and UI:R as the victim must load content; S:C with C/I/A:H reflect the sandbox escape into a more privileged process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

3.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:34 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and is second-stage: it is not directly exploitable from the open web without a prior renderer compromise. No public exploit has been identified at time of analysis, and its EPSS exploitation probability is low (0.17%, 7th percentile); notably, Google rated the Chromium security severity as Low despite the NVD CVSS of 9.6.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL API calls into the platform's native backend (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE sits in the GPU/renderer path and processes attacker-influenceable WebGL content, memory-safety bugs there are a recurring sandbox-escape surface. The root cause is CWE-416 use-after-free: an object is freed while a dangling reference remains, and subsequent access to that freed memory - driven by a crafted HTML/WebGL page - allows memory corruption in a more privileged context. In Chrome's multi-process model the renderer is sandboxed, so a UAF reachable from a compromised renderer that touches the GPU/browser boundary can be leveraged to escape that sandbox.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on the Stable desktop channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Chrome auto-updates on relaunch, so the primary action is to force a browser restart across the fleet to apply the fix; verify via chrome://settings/help. Users of Chromium-based browsers should apply their vendor's build that incorporates the corresponding ANGLE fix. As an interim compensating control where patching is delayed, reduce the attack surface by disabling hardware-accelerated/WebGL rendering (chrome://settings, 'Use graphics acceleration when available', or enterprise policy HardwareAccelerationModeEnabled=false), which lowers exposure of the ANGLE path at the cost of degraded graphics performance and broken WebGL/GPU-accelerated content; because exploitation also requires a pre-compromised renderer, keeping the renderer sandbox and Site Isolation enabled remains the most important control.