What is the CVSS score of CVE-2026-14088?

CVE-2026-14088 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14088?

Yes, a patch is available for CVE-2026-14088. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-14088

EUVD-2026-40775 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-437f-8gm2-935w

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted web page with no privileges needed; user must visit the page (UI:R); only confidentiality is impacted as memory is read but not written.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:41 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Uninitialized memory read in the Canvas API of Google Chrome on Android (prior to 150.0.7871.47) exposes potentially sensitive process memory contents to remote attackers. Exploitation requires luring a target to a crafted HTML page, after which the uninitialized Canvas buffer may leak memory from the renderer process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Chromium's own security team rates severity as Low despite the NVD CVSS score of 6.5.

Technical ContextAI

The HTML Canvas API provides a scriptable 2D drawing surface rendered by the browser's compositor. CWE-457 (Use of Uninitialized Variable) indicates that when a Canvas object or backing buffer is allocated, some memory region is read or returned to JavaScript before being fully initialized, potentially exposing heap or stack contents from prior allocations in the same renderer process. This class of bug is Android-specific here, suggesting the vulnerability may relate to Android's GPU memory handling, Skia rendering backend, or a platform-specific code path in Chrome's Canvas implementation. The affected CPE is Google Chrome for Android versions below 150.0.7871.47.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later, available via the Google Play Store or Chrome's built-in update mechanism. The vendor advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators managing Android device fleets via EMM/MDM solutions should push this update through their managed Chrome update channels. As a compensating control prior to patching, restricting user access to untrusted or external web content via browser policy (e.g., URL allowlisting) would reduce exposure, though this is operationally disruptive. Given the Low Chromium severity rating, the patch alone is the appropriate and sufficient remediation.