What is the CVSS score of CVE-2026-14099?

CVE-2026-14099 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14099?

Google Chrome for iOS users are vulnerable to a memory corruption issue (CVE-2026-14099) that could be triggered through malicious webpages, but no public exploit has been identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-14099?

Within 24 hours, identify the number of iOS devices running Chrome in your organization and verify patch availability through the Chrome App Store or your mobile device management platform. Within 7 days, distribute Chrome version 150.0.7871.47 or later to iOS users via your standard mobile deployment channel (App Store automatic updates, MDM enforcement, or user notification). Within 30 days, conduct an audit to confirm all iOS Chrome instances have been updated to the patched version and document compliance status.

Google Chrome CVE-2026-14099

EUVD-2026-40786 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-x5p7-9cw8-wr27

Denial Of Service Google Use After Free Memory Corruption Apple Red Hat

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered UAF with no auth, but requires specific user gestures and reliable heap grooming, so UI:R and AC:H; full renderer compromise keeps C/I/A High.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:17 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Heap corruption via use-after-free affects Google Chrome for iOS prior to 150.0.7871.47, where a remote attacker serving a crafted HTML page can trigger memory corruption after luring the victim into performing specific UI gestures. Chromium rated the issue Low severity, and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation. A vendor patch is available, so the practical priority is routine browser-update hygiene rather than emergency response.

Technical ContextAI

The flaw is a CWE-416 use-after-free: a heap object is freed while a dangling reference remains reachable, so subsequent use corrupts the heap and can be groomed toward controlled memory writes and potential code execution within the renderer. It resides in Chrome's iOS build (the mobile Chrome browser distributed via Apple's App Store), reached through a crafted HTML page rendered by the browser. The CPE provided (cpe:2.3:a:google:chrome) is the generic Chrome application identifier and is not iOS-specific, so it should be read alongside the description, which explicitly scopes this to Chrome for iOS.

RemediationAI

Vendor-released patch: update Google Chrome for iOS to 150.0.7871.47 or later via the Apple App Store; enable automatic app updates so the fix rolls out to managed and BYOD devices without user action. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html to confirm the build. Until devices are updated, the practical compensating control is user awareness - because exploitation requires the victim to load an attacker page and perform specific UI gestures, advise users to avoid untrusted links and unexpected interaction prompts; MDM/web-filtering to block known-malicious domains reduces exposure but does not eliminate the vector. There is no server-side toggle to disable the affected code path, so patching is the only reliable fix.