What is the CVSS score of CVE-2026-14104?

CVE-2026-14104 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14104?

Google Chrome desktop before version 150.0.7871.47 contains a critical remote code execution vulnerability (CVSS 9.8) exploitable by directing users to malicious webpages, creating a broad…. A patch is available.

How to fix or mitigate CVE-2026-14104?

Within 24 hours: Confirm auto-update status for Chrome and document desktop deployment scope. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all Chrome-using endpoints organization-wide. Within 30 days: Audit deployment to achieve 100% patch coverage.

Google Chrome CVE-2026-14104

EUVD-2026-40791 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-w23p-qfgf-phf7

RCE Google Red Hat Suse

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Delivered via a page the victim must open (UI:R); execution stays inside the renderer sandbox with no escape, so impacts are Limited (C:L/I:L/A:L) and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 14:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 14:52 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 14:52 NVD

8.8 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 01, 2026 - 15:36 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionNVD

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandboxed remote code execution in Google Chrome desktop before 150.0.7871.47 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page, exploiting insufficient input validation in the WebAppInstalls component. Google rates the Chromium severity as Low because execution is contained within the sandbox and no escape is included, and there is no public exploit identified at time of analysis. EPSS is low (0.21%, 12th percentile) and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw lives in Chrome's WebAppInstalls path, the browser subsystem that handles installation and manifest processing for Progressive Web Apps / installable web applications. The root cause is classed as CWE-20 (Improper Input Validation): untrusted data delivered via a web page is not adequately validated before use, allowing an attacker to corrupt program state and achieve code execution - but critically, only within the renderer/sandbox boundary rather than the privileged browser process. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Google Chrome desktop application. Chromium's multi-process sandbox architecture is the reason Google grades this Low despite the total in-process technical impact: without a chained sandbox escape, the attacker remains confined.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); restart the browser to complete the update since Chrome only applies a staged update after relaunch. In managed environments, push the update through your existing Chrome enterprise update policy and confirm the version rolls to 150.0.7871.47+. If immediate patching is not possible, reduce exposure by limiting use of installable web apps / PWA installation prompts and restricting users from installing untrusted web apps via enterprise policy; note the trade-off that disabling web-app install functionality breaks legitimate PWA workflows. Because exploitation requires visiting attacker-controlled content, reinforcing web-content filtering and cautioning users against untrusted links provides partial defense until the update is deployed.