What is the CVSS score of CVE-2026-14098?

CVE-2026-14098 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14098?

Yes, a patch is available for CVE-2026-14098. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14098

EUVD-2026-40785 MEDIUM

Information Exposure (CWE-200)

2026-06-30 chrome-cve-admin@google.com

GHSA-58f8-x78x-fpf7

Information Disclosure Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered CSS exploit requires only victim page navigation (UI:R), no attacker privileges; high confidentiality from cross-origin data exfiltration, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:18 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 allows a remote attacker who can lure a user to a crafted HTML page to bypass same-origin isolation via an inappropriate CSS implementation and exfiltrate sensitive data from other origins. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no integrity or availability effects, though Chromium's own security team rated severity as Low and SSVC confirms no current exploitation. No public exploit code has been identified, and EPSS of 0.17% (7th percentile) aligns with the low observed exploitation probability.

Technical ContextAI

The vulnerability stems from an inappropriate implementation in Chrome's CSS processing engine, rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). CSS-based cross-origin information leaks typically exploit rendering side channels, timing differentials, or improper isolation of style computation between browsing contexts - enabling a malicious page to infer or directly read data belonging to a different origin. The affected product is Google Chrome, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with all stable channel versions below 150.0.7871.47 confirmed vulnerable per the EUVD affected version range. The SUSE tag in the metadata indicates that SUSE and openSUSE Linux distributions package affected Chromium versions and require downstream-specific security updates independent of the upstream Chrome release.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this update automatically for most desktop users. For enterprise deployments managed via policy, push the update through Google Admin or your endpoint management tooling and verify rollout with chrome://policy. As an interim compensating control where immediate patching is infeasible, enforcing Chrome's Site Isolation (--site-per-process, enabled by default in modern Chrome) limits the cross-origin surface area; however, this does not fully remediate the underlying CSS implementation flaw and should not substitute for patching. SUSE-packaged Chromium deployments should monitor SUSE Security Advisories for a corresponding downstream update and apply it promptly.