What is the CVSS score of CVE-2026-14085?

CVE-2026-14085 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14085?

Yes, a patch is available for CVE-2026-14085. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14085

EUVD-2026-40772 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-06-30 chrome-cve-admin@google.com

GHSA-fx2c-jqxx-qwcv

Information Disclosure Google Suse Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

3.4 LOW

Side-channel exploitation requires controlled timing conditions (AC:H); leaking another origin's data implies scope change (S:C) with partial confidentiality loss (C:L), not full disclosure.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:29 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables remote attackers to exfiltrate cross-origin data by luring victims to a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H) with network access and no authentication required from the attacker, though user interaction is necessary. Despite the NVD Medium score of 6.5, Google's internal Chromium severity rating is Low, EPSS sits at just 0.17% (7th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis - signals that collectively indicate limited real-world exploitability.

Technical ContextAI

CWE-1300 (Improper Protection of Physical Side Channels) in a browser context encompasses timing, rendering, or resource-loading side-channel attacks that allow an attacker-controlled page to infer information about content rendered in a different security origin. CSS-based side channels in Chromium typically exploit browser rendering behaviors - such as differential paint timing, style resolution order, or selector-matching latency - to probe the state of cross-origin resources without directly violating the Same-Origin Policy. The affected product is Google Chrome for desktop on all platforms in versions prior to 150.0.7871.47, as confirmed by EUVD-2026-40772 and the Chrome Releases advisory.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later immediately via the browser menu (Help > About Google Chrome) or via enterprise deployment tooling; the vendor advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No specific workaround has been documented by Google for this issue. As an interim compensating control where patching is delayed, enabling Chrome's Site Isolation feature (chrome://flags/#enable-site-per-process) may limit the cross-origin data accessible to the side channel, though this feature is already enabled by default in recent Chrome versions. Restricting user navigation to untrusted or unknown websites via proxy policy or browser extension allowlists reduces exposure to crafted attacker pages, at the cost of user browsing friction.