What is the CVSS score of CVE-2026-14103?

CVE-2026-14103 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14103?

Yes, a patch is available for CVE-2026-14103. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14103

EUVD-2026-40790 MEDIUM

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8f8q-px67-7j76

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page requires active user interaction (UI:R); no privileges needed on attacker side; impact confined to confidentiality within the browser process only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:42 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Use-after-free in Chrome's SSL handling on ChromeOS exposes process memory contents to remote attackers who can serve a crafted HTML page. Only ChromeOS builds of Chrome prior to 150.0.7871.47 are affected - this is not a cross-platform flaw. SSVC rates exploitation status as none and technical impact as partial, and Chromium's own severity classification is Low, making this a routine patch-cycle priority rather than an emergency response item despite the CVSS 6.5 score.

Technical ContextAI

CWE-416 (Use After Free) describes a class of memory-safety bug where code continues to reference a pointer to memory that has already been freed. In this case the defect resides specifically in Chrome's SSL subsystem on ChromeOS, suggesting either a ChromeOS-specific code path or a platform-specific integration of the SSL stack that is absent in other builds. When freed SSL objects are subsequently accessed - for example, during SSL session teardown triggered by page content - stale memory contents can be read, potentially leaking any data co-located with that freed allocation, such as keys, session state, or adjacent heap objects. The ChromeOS-only scope implies the root cause may be in platform-layer SSL handling code rather than the cross-platform BoringSSL core.

RemediationAI

Update Google Chrome on ChromeOS to version 150.0.7871.47 or later, which contains the vendor-released fix for this use-after-free. The patch is distributed through the Chrome stable channel and is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. ChromeOS devices enrolled in auto-update policies should receive the fix automatically; administrators managing enterprise ChromeOS fleets via Google Admin Console should confirm that minimum version enforcement policies are set to 150.0.7871.47 or higher. No configuration-level workaround neutralizes the SSL-layer defect without patching; however, restricting ChromeOS users to approved URL allowlists via enterprise web filtering would reduce exposure to attacker-hosted pages until the update is applied, at the cost of limiting general browsing access.