What is the CVSS score of CVE-2026-14067?

CVE-2026-14067 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome for iOS are affected by CVE-2026-14067?

Google Chrome for iOS versions prior to 150.0.7871.47 contain a use-after-free vulnerability (CVSS 8.8) enabling remote browser process compromise when users load malicious web content.. A patch is available.

How to fix or mitigate CVE-2026-14067?

Within 24 hours, identify Google Chrome for iOS deployment scope across managed and BYOD devices and distribute a security alert with CVE-2026-14067 details to all users. Within 7 days, deploy Chrome version 150.0.7871.47 or later through your MDM solution to all managed iOS devices and formally direct employees to manually update Chrome on personal devices. Within 30 days, audit patch compliance organization-wide, verify no devices remain on vulnerable versions, and configure endpoint detection to monitor for exploitation indicators.

Chrome for iOS CVE-2026-14067

EUVD-2026-40754 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-f75r-xcg5-hgf3

RCE Denial Of Service Google Use After Free Memory Corruption Apple Red Hat

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); a UAF RCE yields full C/I/A within the unchanged browser process scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:20 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome for iOS prior to 150.0.7871.47 stems from a use-after-free (CWE-416) that a remote attacker can trigger when a victim loads a crafted HTML page. Despite Chromium rating the underlying bug 'Low' severity, the NVD CVSS scores it 8.8 (High) because successful exploitation yields full compromise of the browser process. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile), with CISA SSVC recording no observed exploitation.

Technical ContextAI

The flaw is a use-after-free (CWE-416), a memory-corruption class where code references heap memory after it has been freed, letting an attacker groom the heap to reclaim that allocation and gain control over freed-object contents. It affects Google Chrome on iOS specifically; note that Chrome on iOS is built atop Apple's WKWebView/WebKit engine rather than Blink/V8 due to App Store rules, so the affected component differs from desktop Chrome despite the shared 'chrome' CPE (cpe:2.3:a:google:chrome:*). Use-after-free bugs in browser renderer/DOM handling are a recurring root cause of drive-by RCE, and the 'Memory Corruption' and 'RCE' tags reinforce that the vulnerable path is reachable through untrusted web content.

RemediationAI

Vendor-released patch: update Google Chrome for iOS to 150.0.7871.47 or later via the Apple App Store; on managed iOS fleets, push the update through MDM to force compliance. Because Chrome on iOS auto-updates through the App Store, most users receive the fix automatically, but verify the installed build in Chrome settings for high-value devices. There is no vendor-documented configuration workaround; as an interim compensating control, restrict browsing to trusted sites or use MDM web-content filtering to reduce exposure to attacker-controlled HTML pages, accepting the usability trade-off that legitimate sites may be blocked. Consult the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) for release details.