What is the CVSS score of CVE-2026-14091?

CVE-2026-14091 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14091?

Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the DevTools component allowing remote code execution confined to the browser sandbox.. A patch is available.

How to fix or mitigate CVE-2026-14091?

Within 24 hours, identify all Chrome installations across your estate and prepare deployment of version 150.0.7871.47, available now in the Stable channel. Within 7 days, complete distribution of Chrome 150.0.7871.47 to all managed endpoints via your standard software update process. Within 30 days, audit 100% patch compliance and establish automated monitoring to detect systems running pre-150.0.7871.47 versions.

Google Chrome CVE-2026-14091

EUVD-2026-40778 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-46x6-9622-7q2g

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted page (AV:N/AC:L/PR:N) needs a user to open it (UI:R); code runs in the unchanged renderer sandbox (S:U) with full control of that process (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:19 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox-contained arbitrary code execution in Google Chrome (Chromium DevTools component) before version 150.0.7871.47 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416); Google rated its Chromium security severity as Low because execution is confined to the sandbox rather than the host OS. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and CISA SSVC lists exploitation as none - but a vendor patch is already available in the Stable channel.

Technical ContextAI

The defect lives in Chrome's DevTools subsystem, which is built on the Chromium/Blink rendering engine and the Chrome DevTools Protocol used for page inspection and debugging. CWE-416 (use-after-free) means an object is freed while a dangling pointer to it remains reachable; subsequent access lets an attacker control freed heap memory and ultimately hijack execution. Per the CPE (cpe:2.3:a:google:chrome), the affected artifact is the Chrome desktop browser application; because Chromium is the upstream base, downstream Chromium-derived browsers (and the SUSE-packaged builds noted in the tags) may inherit the same flaw until they rebase. Critically, the description scopes code execution to 'inside a sandbox' - the renderer process - so a second sandbox-escape bug would be required to reach the underlying operating system.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 (Stable channel) - upgrade to this version or later, which for most users happens automatically once the browser is restarted, so instruct users to relaunch Chrome to apply the pending update and verify via chrome://settings/help. Reference the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations running Chromium-derived or SUSE-packaged browsers should track and apply their distributor's rebased build. As a compensating control until patching, you can reduce the specific attack surface by discouraging or restricting DevTools usage on untrusted pages and by using enterprise policy to enforce prompt browser updates; broadly blocking DevTools is impractical for developer populations and offers limited benefit given the low real-world exploitation risk, so prioritizing the automatic update rollout is the pragmatic path.