What is the CVSS score of CVE-2026-14050?

CVE-2026-14050 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14050?

Yes, a patch is available for CVE-2026-14050. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14050

EUVD-2026-40737 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-2pj2-8f73-8vw2

Information Disclosure Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

C downgraded from H to L to reconcile Chromium's own Low severity rating, implying limited data exposure scope rather than full credential disclosure.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:34 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Passwords component prior to version 150.0.7871.47 enables remote attackers to exfiltrate credential-related or other sensitive cross-origin data by directing victims to a crafted HTML page. The root cause (CWE-693, Protection Mechanism Failure) represents a breakdown in the policy enforcement layer governing cross-origin access in the Passwords subsystem - a bypass of the isolation guarantees Chrome's same-origin model is meant to provide. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page targeting Passwords policy enforcement

Exploit

Victim navigates to attacker-controlled URL in unpatched Chrome

Execution

Policy enforcement failure triggered in Chrome Passwords subsystem

Impact

Cross-origin data exfiltrated to attacker

Access

Attacker crafts malicious HTML page targeting Passwords policy enforcement

Exploit

Victim navigates to attacker-controlled URL in unpatched Chrome

Execution

Policy enforcement failure triggered in Chrome Passwords subsystem

Impact

Cross-origin data exfiltrated to attacker

Vulnerability AssessmentAI

Exploitation	Victim must be running Google Chrome stable channel prior to version 150.0.7871.47 on any desktop platform. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns High confidentiality impact, which - taken at face value - would suggest meaningful data exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and publishes a crafted HTML page that exploits Chrome's insufficient policy enforcement in the Passwords component; when a victim running an unpatched Chrome version visits the page - via a phishing link, malicious advertisement, or compromised third-party site - the page reads cross-origin data it should be forbidden from accessing and exfiltrates it to attacker-controlled infrastructure. No public proof-of-concept exists at time of analysis, and the mandatory user-navigation step limits mass exploitation potential.
Remediation	Update Google Chrome to version 150.0.7871.47 or later immediately via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or by downloading directly from the stable channel release noted at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.