What is the CVSS score of CVE-2026-14100?

CVE-2026-14100 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14100?

Yes, a patch is available for CVE-2026-14100. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14100

EUVD-2026-40787 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-5q2c-j4wm-4656

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

UI:R required as victim must visit crafted page; C:H reflects cross-origin cache read; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:30 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's NetworkCache component affects all desktop versions prior to 150.0.7871.47, enabling remote attackers to read sensitive cached data belonging to other origins. Exploitation requires a victim to visit a specially crafted HTML page, placing this squarely in the browser-based phishing and malvertising threat model. No public exploit code or active exploitation has been identified; an EPSS score of 0.17% (7th percentile) and Chromium's own Low severity classification indicate low immediate exploitation probability despite the Medium CVSS base score.

Technical ContextAI

The vulnerability resides in Chrome's NetworkCache subsystem - the component responsible for storing and replaying HTTP responses to accelerate page loads and reduce redundant network requests. CWE-20 (Improper Input Validation) indicates the cache does not adequately validate data before making it accessible to requesting browsing contexts, which creates a cross-origin information leak: a security model violation where content fetched on behalf of one origin (e.g., a banking site) becomes readable by a different, attacker-controlled origin. The affected product is Google Chrome (Chromium-based) on desktop, versions prior to 150.0.7871.47, as confirmed by the EUVD entry EUVD-2026-40787 and the Google Chrome Releases advisory.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch addressing this vulnerability; the stable channel advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should apply this patch automatically for most users; administrators managing enterprise deployments via Google Chrome Browser Cloud Management or group policy should verify rollout completion. As a compensating control prior to patching, deploying web filtering or DNS-based blocking of known phishing and malvertising infrastructure reduces the likelihood of users reaching a crafted exploitation page, though this does not address the underlying cache validation flaw. Enabling Chrome's Enhanced Safe Browsing mode provides additional pre-visit URL checks and may intercept crafted pages before they load.