What is the CVSS score of CVE-2026-14056?

CVE-2026-14056 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14056?

Google Chrome versions prior to 150.0.7871.47 contain a critical sandbox escape vulnerability in the Media component that could allow post-compromise attackers to escalate from renderer process…. A patch is available.

How to fix or mitigate CVE-2026-14056?

24 hours: Audit Chrome version inventory across all enterprise systems to identify installations prior to 150.0.7871.47. 7 days: Begin staged rollout of Chrome version 150.0.7871.47 or later to pilot systems using existing patch management infrastructure. 30 days: Complete deployment to all enterprise endpoints.

Google Chrome CVE-2026-14056

EUVD-2026-40743 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-5wmq-8c77-hhq5

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation is chained and requires a pre-compromised renderer; UI:R for the crafted media, S:C and C/I/A:H reflect the sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:29 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's Media component before version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the sandbox using a crafted video file. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a scope-changing CVSS 3.1 score of 9.6, though Google rated the underlying Chromium severity as Low and no public exploit has been identified at time of analysis. EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Chrome's Media subsystem, which parses and decodes audio/video content. Chrome uses a multi-process architecture where untrusted web content is confined to a sandboxed renderer process; a sandbox escape is the second link in a chain that lets attacker-controlled code in the renderer reach the more-privileged browser process and the host OS. The root cause is CWE-20 (Improper Input Validation) - a crafted video file is not adequately validated before processing, and because media handling can cross the renderer/GPU/browser trust boundary, the malformed input can be leveraged to violate the sandbox. The single affected product per EUVD is Google Chrome (Chrome 150.0.7871.47, all builds prior to 150.0.7871.47); no formal CPE strings were provided in the input, so exact configuration matching relies on the vendor version cutoff.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome to 150.0.7871.47 or later, which is delivered through Chrome's automatic Stable channel update mechanism (verify via chrome://settings/help and relaunch to apply). Enterprises managing Chrome via policy should confirm auto-update is enabled and not pinned to an older milestone, and push the update through their management tooling. As an interim compensating control while updates roll out, restrict exposure to the earlier renderer-compromise stage of the chain by keeping renderer sandbox hardening and site isolation enabled (both default in Chrome) and avoiding untrusted sites, since the bug is only reachable after a renderer is already compromised; disabling the media handling that processes crafted video is not practical without breaking core browsing, so patching is the correct path. See the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.