What is the CVSS score of CVE-2026-14094?

CVE-2026-14094 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14094?

Google Chrome's Windows installer (versions before 150.0.7871.47) is vulnerable to privilege escalation, allowing local attackers to execute code with system privileges; no public exploit has been…. A patch is available.

How to fix or mitigate CVE-2026-14094?

Within 24 hours, identify Chrome versions currently deployed across Windows endpoints and assess exposure to users with installer access. Within 7 days, deploy Chrome version 150.0.7871.47 or later to all affected systems, prioritizing endpoints with administrative users. Within 30 days, verify deployment completion, audit installation logs for suspicious activity, and establish automated update policies to prevent version drift.

Google Chrome CVE-2026-14094

EUVD-2026-40781 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-c3m3-f85p-m2r3

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat

High

Disputed · 7.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local installer flaw needing no prior privileges but victim-triggered install (UI:R); successful UAF yields code execution in the elevated installer context, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:18 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)

AnalysisAI

OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.

Technical ContextAI

The flaw lives in the Chrome Installer on Windows and is classified as CWE-416 (Use After Free), a memory-corruption class where a pointer to freed heap memory is reused, letting an attacker control the contents of the reallocated region to hijack execution flow. Because the vulnerable code path runs within the installer - a process that typically executes with elevated/SYSTEM privileges to write into Program Files and register components - successfully controlling the freed object yields code execution at that higher privilege level. The affected CPE is cpe:2.3:a:google:chrome (all versions prior to the fix), and the issue is platform-specific to the Windows installer rather than the browser's rendering or sandbox layers.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - upgrade to this version or later on Windows, then fully restart the browser so the update is applied (Chrome auto-updates, but a relaunch is required to complete installation). Confirm rollout via the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation depends on a local attacker placing a malicious file that the installer processes, interim compensating controls include restricting local/interactive access on multi-user Windows hosts, enforcing least privilege so untrusted users cannot stage files into installer-read locations, and monitoring for unexpected file drops or installer executions; these controls reduce opportunity but do not remove the underlying use-after-free, so patching remains the definitive fix.