What is the CVSS score of CVE-2026-14100?

CVE-2026-14100 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14100?

Yes, a patch is available for CVE-2026-14100. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14100

EUVD-2026-40787 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-5q2c-j4wm-4656

Information Disclosure Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

UI:R required as victim must visit crafted page; C:H reflects cross-origin cache read; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:30 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's NetworkCache component affects all desktop versions prior to 150.0.7871.47, enabling remote attackers to read sensitive cached data belonging to other origins. Exploitation requires a victim to visit a specially crafted HTML page, placing this squarely in the browser-based phishing and malvertising threat model. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page

Delivery

Lure victim via phishing or malvertising

Exploit

Victim loads page in vulnerable Chrome

Execution

Trigger NetworkCache input validation flaw

Persist

Read cached responses from victim's other origins

Impact

Exfiltrate sensitive data to attacker server

Access

Host crafted HTML page

Delivery

Lure victim via phishing or malvertising

Exploit

Victim loads page in vulnerable Chrome

Execution

Trigger NetworkCache input validation flaw

Persist

Read cached responses from victim's other origins

Impact

Exfiltrate sensitive data to attacker server

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim is running Google Chrome prior to version 150.0.7871.47 on a desktop platform and actively navigates to or loads a crafted HTML page controlled by the attacker - confirmed by CVSS UI:R (active user interaction required). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - a network-reachable, low-complexity attack requiring no attacker privileges but mandatory victim interaction, with high confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and serves a crafted HTML page engineered to abuse Chrome's NetworkCache validation flaw. A victim is directed to the page via a phishing email or malicious advertisement; upon page load, the attacker's JavaScript triggers the cache leak, reading cached responses from other origins - potentially extracting authentication tokens, partial form data, or API responses from banking or webmail sites the victim recently visited. …
Remediation	Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch addressing this vulnerability; the stable channel advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.