What is the CVSS score of CVE-2026-14060?

CVE-2026-14060 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14060?

Chrome Remote Desktop on Windows (versions before 150.0.7871.47) contains a privilege escalation vulnerability allowing local attackers to gain administrative access.. A patch is available.

How to fix or mitigate CVE-2026-14060?

Within 24 hours: Identify Windows systems running Chrome before version 150.0.7871.47 with Chrome Remote Desktop enabled; notify relevant teams. Within 7 days: Deploy Chrome version 150.0.7871.47 or later; restrict Chrome Remote Desktop access to essential personnel only. Within 30 days: Audit and confirm 100% patch compliance; implement endpoint detection for privilege-escalation attempts.

Google Chrome CVE-2026-14060

EUVD-2026-40747 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-rxj2-2vwr-7xr8

Privilege Escalation Google Microsoft Red Hat Suse

High

Disputed · 7.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local malicious-file vector (AV:L) needing no prior privileges (PR:N) but victim interaction (UI:R); successful privilege escalation yields full high C/I/A on the host.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:34 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

AnalysisAI

Local privilege escalation in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows before 150.0.7871.47 allows a local attacker who plants a malicious file to elevate privileges after the victim interacts with it. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a 7.8 CVSS but was rated Low severity by Chromium's own team. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.13%, 3rd percentile), consistent with a local, interaction-dependent issue rather than a mass-exploitable one.

Technical ContextAI

Chromoting is the internal codename for the Chrome Remote Desktop subsystem bundled with Google Chrome, which brokers remote-access sessions and handles associated host/client files on the Windows platform. The root cause is classified as CWE-20 (Improper Input Validation): the component accepts a file whose contents or path attributes are not sufficiently checked, so a maliciously crafted file can influence execution in a higher-privileged context. Because Chromoting components can run with elevated rights on Windows (host services, native messaging helpers), a validation gap in how these files are parsed or loaded provides a route from a low-privileged local user to escalated privileges.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 for Windows - upgrade to this version or later, which Chrome typically applies automatically on restart, so ensuring the browser is fully closed and relaunched is the primary fix (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). In managed fleets, push the update via your enterprise management/GPO and verify the running version. As an interim compensating control until patched, disable or uninstall Chrome Remote Desktop (Chromoting) on hosts that do not require it and restrict interactive/local login to trusted users, since exploitation depends on a local attacker planting a file and a user interacting with it; the trade-off is loss of remote-desktop functionality for legitimate users on those hosts.