What is the CVSS score of CVE-2026-14084?

CVE-2026-14084 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14084?

Google Chrome Remote Desktop (Chromoting) in Chrome versions before 150.0.7871.47 contains a heap corruption vulnerability that could allow remote attackers to execute arbitrary code within active…. A patch is available.

How to fix or mitigate CVE-2026-14084?

Within 24 hours: Inventory Chrome installations with Remote Desktop enabled across enterprise. Within 7 days: Validate Chrome 150.0.7871.47 or later in non-production environment; test Remote Desktop functionality post-patch. Within 30 days: Deploy patched Chrome version to all vulnerable systems; prioritize machines handling sensitive data or remote access.

Google Chrome CVE-2026-14084

EUVD-2026-40771 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7w49-3h8x-hw3c

Information Disclosure Google Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered but requires an active remote-desktop session and shaping heap corruption into exploitation, so AC:H and UI:R; no privileges needed (PR:N) and memory corruption yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:34 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Heap corruption in the Chromoting (Chrome Remote Desktop) component of Google Chrome before 150.0.7871.47 lets a remote attacker deliver malicious network traffic to a victim's active remote session, potentially corrupting heap memory and enabling arbitrary code execution in the browser process. All desktop Chrome installs using Chrome Remote Desktop below the fixed build are affected. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation as none; EPSS is low at 0.16% (6th percentile), so this is a patch-during-normal-cycle item rather than an emergency.

Technical ContextAI

Chromoting is the internal codename for Chrome Remote Desktop, the network-based remote-access subsystem built into Chrome and Chromium. The flaw is classed as CWE-20 (Improper Input Validation): the component insufficiently validates untrusted data arriving over the remote-desktop network channel, and that malformed input drives a heap corruption condition (out-of-bounds write or invalid allocation state on the heap). Because parsing/deserialization of session traffic happens inside a Chrome process, successful heap corruption can be steered toward memory-safety exploitation. The affected code path is only reachable when a Chrome Remote Desktop session is active and processing attacker-influenced traffic.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms (Windows, macOS, Linux) - this is the primary and complete fix. Trigger Chrome's built-in updater or push the new build via enterprise management, then relaunch the browser to apply it, and confirm the version in chrome://settings/help. Details are in the Chrome Stable channel advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html (issue https://issues.chromium.org/issues/513138148). As an interim compensating control until updates land, disable or uninstall Chrome Remote Desktop or restrict who may host or connect to remote sessions, since the vulnerable Chromoting code path is only exercised when a remote-desktop session is active; the trade-off is loss of remote-access functionality for legitimate users. Where remote desktop is required, limit connections to trusted peers and networks to reduce exposure to malicious traffic.