What is the CVSS score of CVE-2026-14103?

CVE-2026-14103 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14103?

Yes, a patch is available for CVE-2026-14103. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14103

EUVD-2026-40790 MEDIUM

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8f8q-px67-7j76

Memory Corruption Denial Of Service Use After Free Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page requires active user interaction (UI:R); no privileges needed on attacker side; impact confined to confidentiality within the browser process only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:42 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Use-after-free in Chrome's SSL handling on ChromeOS exposes process memory contents to remote attackers who can serve a crafted HTML page. Only ChromeOS builds of Chrome prior to 150.0.7871.47 are affected - this is not a cross-platform flaw. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to page on ChromeOS Chrome

Exploit

SSL session teardown triggers use-after-free

Execution

Freed process memory contents read

Impact

Sensitive in-memory data disclosed to attacker

Access

Attacker hosts crafted HTML page

Delivery

Victim navigates to page on ChromeOS Chrome

Exploit

SSL session teardown triggers use-after-free

Execution

Freed process memory contents read

Impact

Sensitive in-memory data disclosed to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires a ChromeOS device running Google Chrome prior to version 150.0.7871.47 - the flaw does not affect Chrome on any other operating system. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5, driven primarily by the High confidentiality impact, but several factors moderate real-world risk considerably. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts an HTML page with content specifically designed to trigger a use-after-free during SSL session handling in Chrome on ChromeOS. After luring a victim - via phishing link, malicious ad, or compromised site - to visit the page, the freed SSL memory is accessed and its contents are returned to the attacker, potentially exposing session tokens, cached credentials, or other heap-resident data from the browser process. …
Remediation	Update Google Chrome on ChromeOS to version 150.0.7871.47 or later, which contains the vendor-released fix for this use-after-free. … Detailed patch versions, workarounds, and compensating controls in full report.