What is the CVSS score of CVE-2026-14097?

CVE-2026-14097 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14097?

Google Chrome on macOS versions prior to 150.0.7871.47 contains a critical privilege escalation flaw that transforms renderer process compromise into complete system compromise, with no public…. A patch is available.

How to fix or mitigate CVE-2026-14097?

Within 24 hours: Identify all macOS systems running Chrome versions prior to 150.0.7871.47 and prepare a test environment to validate patch deployment. Within 7 days: Deploy Chrome 150.0.7871.47 or later through your standard macOS patch management to all affected systems. Within 30 days: Verify complete patch deployment and review browser security policy to minimize renderer compromise risk.

Google Chrome CVE-2026-14097

EUVD-2026-40784 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-r7gr-w5gq-fjxx

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a pre-compromised renderer (PR:H) and reliable chaining of a separate bug (AC:H); success crosses the sandbox boundary (S:C) yielding high host impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:23 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebAppInstalls component. Chromium rated the underlying issue Low severity even though the CVSS base score is 9.6, and there is no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile). The vulnerability is a second-stage primitive that requires prior renderer code execution, not a standalone drive-by.

Technical ContextAI

The flaw lives in Chrome's WebAppInstalls feature, the browser subsystem responsible for installing and managing Progressive Web Apps / installed web applications on macOS. The root cause maps to CWE-693 (Protection Mechanism Failure): the sandbox boundary that is supposed to confine a compromised renderer is not correctly enforced by this component, letting attacker-controlled renderer code reach higher-privileged browser-process functionality. Chrome's multi-process model isolates untrusted web content in a sandboxed renderer; a Protection Mechanism Failure here means the isolation control itself is defeated rather than a memory-safety bug being the primary vector. The issue is macOS-specific, implicating the platform-specific implementation of WebAppInstalls / sandbox policy on Mac.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 for macOS. Update Chrome to 150.0.7871.47 or later via the built-in updater (Chrome menu > About Google Chrome) and relaunch to apply, or push the update through enterprise management (Google Admin console / MDM) to ensure managed Mac fleets restart into the patched build. Because exploitation requires the renderer to be compromised first, the most effective compensating control until patching is to reduce renderer-compromise exposure: keep strict Site Isolation enabled, keep Chrome's sandbox enabled (never launch with --no-sandbox), and restrict installation of untrusted web apps / PWAs, accepting the trade-off that disabling web-app installation removes that convenience feature for users. Reference Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and CVE detail at https://nvd.nist.gov/vuln/detail/CVE-2026-14097.