What is the CVSS score of CVE-2026-14074?

CVE-2026-14074 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14074?

Yes, a patch is available for CVE-2026-14074. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-14074

EUVD-2026-40761 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-06-30 chrome-cve-admin@google.com

GHSA-gj72-r692-rhjx

Information Disclosure Apple Google Suse Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AC:H assigned independently because side-channel attacks require precise timing conditions and are subject to browser noise mitigations; all other metrics align with the provided vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:38 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Side-channel information leakage in the WebAuthentication component of Google Chrome on iOS (prior to 150.0.7871.47) exposes cross-origin data to remote attackers via a crafted HTML page, requiring only that a victim visit attacker-controlled content. The CVSS Confidentiality:High rating reflects the category of cross-origin data exposure, while Chromium's own internal severity classification of Low and an EPSS score of 0.21% (11th percentile) both signal that practical exploitation is considered unlikely at scale. No public exploit is identified at time of analysis and no CISA KEV listing exists.

Technical ContextAI

CWE-1300 (Improper Protection of Physical Side Channels) covers scenarios where a system leaks information through observable behavioral differences - such as timing variance, cache state, or power consumption - rather than via direct memory disclosure. In this case, the vulnerable component is the WebAuthentication (WebAuthn/FIDO2) API implementation within Chrome's iOS rendering engine, which uses Apple's WKWebView rather than the desktop Blink/V8 stack. The side-channel allows a page at one origin to observe timing or state artifacts from WebAuthn operations tied to a different origin, violating the Same-Origin Policy in an indirect manner. The affected product per EUVD is Google Chrome on iOS all versions below 150.0.7871.47; no explicit CPE string was provided but the product is unambiguously Chrome on Apple iOS based on the description and tags.

RemediationAI

Upgrade Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. The vendor-released patch is confirmed via the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue tracker at https://issues.chromium.org/issues/511743480. No explicit workarounds are documented in the available references. If immediate patching is constrained by device management policies, the practical risk can be reduced by ensuring users avoid visiting untrusted web pages on iOS Chrome, and by restricting access to WebAuthn-protected enterprise applications from unmanaged iOS devices until patching is confirmed.