What is the CVSS score of CVE-2026-14064?

CVE-2026-14064 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14064?

Google Chrome for Android versions before 150.0.7871.47 contain a remote code execution flaw that could be exploited if employees visit a malicious website.. A patch is available.

How to fix or mitigate CVE-2026-14064?

Within 24 hours, conduct an inventory of Chrome for Android installations across your mobile fleet to determine scope and identify critical user groups. Within 7 days, deploy Chrome for Android 150.0.7871.47 or later through your mobile device management platform or auto-update mechanisms, beginning with high-risk users and devices. Complete rollout to all affected devices by day 30 and verify adoption through MDM reporting.

Google Chrome CVE-2026-14064

EUVD-2026-40751 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-jhpf-pr89-mhqh

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 7.5 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page (AV:N) with no auth (PR:N) but memory-corruption race gives AC:H and mandatory UI gestures give UI:R; full code execution yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:21 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome for Android prior to 150.0.7871.47 stems from a use-after-free in the PageInfo component, allowing a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser process. Chromium rated the security severity Low, and while the CVSS base score is 7.5, the high attack complexity and required user interaction constrain practical exploitation. No public exploit identified at time of analysis, and the EPSS score is low at 0.21% (12th percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's PageInfo feature - the UI surface (the site/permissions panel reachable from the address bar padlock) that displays connection security, permissions, and site data. A use-after-free occurs when a heap object is freed but a dangling pointer is later dereferenced, letting an attacker reclaim the freed allocation with attacker-controlled data to corrupt memory and potentially hijack control flow. The affected CPE is cpe:2.3:a:google:chrome, specifically the Android build; the SSVC technical impact is rated 'total', consistent with memory corruption that can yield full renderer/browser-process compromise. Reaching the vulnerable code path depends on PageInfo UI interactions, which is why the vector requires user gestures rather than passive page rendering.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 150.0.7871.47 or later via the Google Play Store; the fix ships in the Chrome Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because Chrome auto-updates on most Android devices, verify the running version under chrome://settings/help and force an update if the device has update delays or managed configurations. There is no configuration-level workaround for the vulnerable PageInfo code path itself; as a compensating control until updated, advise users not to interact with the site information/padlock panel on untrusted pages and avoid following links to unknown sites, accepting that this only reduces - not eliminates - the interaction-dependent exposure. Enterprises can enforce minimum Chrome versions through mobile device management policy to guarantee the patched build is deployed.