What is the CVSS score of CVE-2026-14090?

CVE-2026-14090 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14090?

A memory disclosure vulnerability in Google Chrome on ChromeOS prior to version 150.0.7871.47 could enable attackers to extract sensitive data from device memory through a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-14090?

Within 24 hours: Identify the total count of ChromeOS devices and determine which are running Chrome versions prior to 150.0.7871.47 using your MDM console or Chrome reporting tools. Within 7 days: Deploy automatic updates to Chrome version 150.0.7871.47 or later across all affected ChromeOS devices using your organization's MDM solution. Within 30 days: Generate compliance report confirming all ChromeOS devices are running version 150.0.7871.47 or later and document the remediation timeline.

Google Chrome CVE-2026-14090

EUVD-2026-40777 HIGH

Out-of-bounds Read (CWE-125)

2026-06-30 chrome-cve-admin@google.com

GHSA-g279-57v2-6c9x

Buffer Overflow Information Disclosure Google Red Hat Suse

High

Disputed · 8.1 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Remote crafted page with user interaction (AV:N/AC:L/PR:N/UI:R); an OOB read primarily discloses memory (C:H) with possible crash (A:L) and no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 15:01 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 15:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 14:52 NVD

CRITICAL HIGH

CVSS changed

Jul 02, 2026 - 14:52 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Jul 01, 2026 - 19:30 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory read in the CameraCapture component of Google Chrome on ChromeOS (versions prior to 150.0.7871.47) lets a remote attacker leak adjacent process memory when a victim opens a crafted HTML page. No public exploit identified at time of analysis, and EPSS is low (0.17%), but the flaw is marked automatable by CISA SSVC. Note a signal conflict: the NVD CVSS is 8.1 (high) while Google rates the Chromium security severity as Low.

Technical ContextAI

The defect is a CWE-125 (Out-of-Bounds Read) in Chrome's CameraCapture code path, which handles camera/media stream capture on ChromeOS. Insufficient validation of untrusted input (attacker-controlled data reaching the capture routine via a web page) causes a read beyond the bounds of an allocated buffer, exposing data from adjacent heap or process memory. The affected software is Google Chrome (CPE cpe:2.3:a:google:chrome), specifically the ChromeOS build; the browser's multi-process/sandbox architecture typically constrains such reads to the renderer or a media-related process rather than the OS kernel.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome / ChromeOS to 150.0.7871.47 or later via the Stable channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Chrome and ChromeOS normally auto-update, so the practical step is to ensure managed devices are not pinned to an older channel/version and to force a relaunch to apply the update. As an interim compensating control, restrict or block camera/media-capture permissions for untrusted sites via enterprise policy (e.g., set VideoCaptureAllowed / site permission defaults to deny), accepting the trade-off that legitimate camera-based web apps will stop working; this narrows exposure to the CameraCapture path until devices are updated.