What is the CVSS score of CVE-2026-14102?

CVE-2026-14102 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14102?

Google Chrome's Passwords component contains a heap corruption vulnerability (CVE-2026-14102) enabling remote code execution when users visit crafted websites, potentially exposing stored credentials…. A patch is available.

How to fix or mitigate CVE-2026-14102?

Within 24 hours: Identify all Chrome instances below version 150.0.7871.47 in your environment. Within 7 days: Deploy Chrome 150.0.7871.47 or later through enterprise update channels; prioritize high-value assets and credential-handling systems. Within 30 days: Verify 100% patch compliance and audit Chrome security controls.

Google Chrome CVE-2026-14102

EUVD-2026-40789 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-vr5v-mvjw-pxv5

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no privileges but mandatory victim interaction (UI:R); UAF heap corruption can yield full renderer compromise, so C/I/A:H, scope unchanged within the sandboxed renderer.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:24 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionNVD

Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Heap corruption via use-after-free in Google Chrome's Passwords component affects all desktop builds prior to 150.0.7871.47, letting a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in the renderer. The CVSS 3.1 vector (8.8) requires user interaction (visiting the page) but no privileges or authentication. No public exploit identified at time of analysis, and the low EPSS score (0.17%, 7th percentile) plus Chromium's own 'Low' severity rating suggest limited real-world exploitation likelihood despite the high CVSS.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's Passwords subsystem (the password manager/autofill infrastructure built on the Blink rendering engine and Chromium's C++ object lifecycle model). A UAF occurs when a pointer is dereferenced after the referenced heap object has been freed, allowing an attacker who controls subsequent heap allocations to groom memory and hijack the dangling pointer. In browser renderers this class of bug is a classic primitive for heap corruption and, when combined with an information leak and sandbox escape, potential renderer-level code execution. Affected component (per CPE/EUVD) is the Google Chrome desktop application across the Stable channel prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; the fix is delivered through Chrome's automatic updater, so ensure clients are not blocking updates and relaunch the browser to apply it (Help > About Google Chrome forces the check). Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of Chromium-based browsers should apply their respective vendor updates once the upstream fix is merged. If patching cannot be completed immediately, compensating controls include restricting browsing to trusted sites and enabling Chrome's Enhanced Safe Browsing, though neither fully mitigates a crafted-page UAF; enterprises can use managed update policies to force the rollout, accepting the trade-off of a forced browser relaunch for users.