What is the CVSS score of CVE-2026-14095?

CVE-2026-14095 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14095?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-14095) that could allow attackers with prior browser compromise to execute code at the host level and…. A patch is available.

How to fix or mitigate CVE-2026-14095?

Within 24 hours: Identify all Chrome desktop installations across the organization. Within 7 days: Deploy Chrome version 150.0.7871.47 or later to all endpoints via your patch management system; enable automatic updates if not already configured. Within 30 days: Verify patch deployment completion and confirm all Chrome desktop installations run version 150.0.7871.47 or later.

Google Chrome CVE-2026-14095

EUVD-2026-40782 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-f382-6c4g-qxjw

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation depends on a pre-existing renderer compromise; UI:R for victim page load; S:C and C/I/A:H reflect a full sandbox escape to the host.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:23 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution on the host via a crafted HTML page. The flaw stems from insufficient policy enforcement in the browser process (CWE-20) and, while carrying a high CVSS base score of 9.6 due to the scope change, was rated only Low severity by Chromium because it is not independently exploitable. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile).

Technical ContextAI

The vulnerability lives in Chrome's multi-process security architecture, where untrusted web content is rendered inside a low-privilege, sandboxed renderer process that must broker all privileged operations through the higher-privilege browser process. CWE-20 (Improper Input Validation) here manifests as insufficient policy enforcement in that browser process: it fails to adequately validate or constrain requests coming from a renderer, so a renderer that is already under attacker control can coax the browser process into actions that cross the sandbox boundary. The affected component is the desktop Chrome/Chromium browser (Windows, macOS, Linux Stable channel) built on the Chromium engine; the fix landed in the Stable channel release 150.0.7871.47 tracked in Chromium issue 513271007.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome to 150.0.7871.47 or later on Windows, macOS, and Linux, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In most environments Chrome's built-in auto-update applies this automatically; confirm by opening chrome://settings/help and restarting the browser to force the update to take effect, and in managed fleets push the updated version through your MDM/Group Policy or the enterprise update infrastructure. Because exploitation requires a pre-existing renderer compromise, interim compensating controls that harden the renderer boundary are relevant: keep Site Isolation enabled (it is on by default and separates sites into distinct renderer processes), and for high-risk users consider enabling Chrome's stricter sandboxing/enhanced protection settings - with the trade-off of occasional compatibility friction on legacy sites. Operators of Chromium-based browsers should apply the corresponding rebased build from their respective vendors.