What is the CVSS score of CVE-2026-14107?

CVE-2026-14107 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14107?

A memory safety vulnerability in Google Chrome (versions before 150.0.7871.47) could allow attackers to execute code on user systems through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-14107?

Within 24 hours: Identify all Chrome installations and current version distribution across the organization. Within 7 days: Deploy Chrome 150.0.7871.47 or later using enterprise push mechanisms; enable auto-update for unmanaged endpoints. Within 30 days: Audit deployment completion and document patch status in the asset inventory system.

Google Chrome CVE-2026-14107

EUVD-2026-40794 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-r265-xc9c-pww5

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs a victim visit (AV:N/UI:R), no privileges (PR:N), and sandboxed RCE yields high C/I/A with scope unchanged (S:U) since the host is not directly compromised.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:36 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Scheduling component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.21% (12th percentile). Google rates the Chromium security severity as Low despite the NVD CVSS of 8.8, reflecting that code execution is confined to the sandbox rather than the host.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Scheduling subsystem, part of the Blink/renderer task-scheduling machinery that orchestrates execution of JavaScript, rendering, and other timed work. A use-after-free occurs when a heap object is freed but a dangling pointer is later dereferenced; an attacker who controls heap layout and timing (readily achievable from JavaScript in an HTML page) can reclaim the freed memory with attacker-controlled data and coerce the reused pointer into arbitrary code execution. Per the EUVD record, all Chrome builds prior to 150.0.7871.47 are affected; the description explicitly notes execution is contained 'inside a sandbox,' meaning a separate sandbox-escape bug would be required to reach the host OS.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Chrome to 150.0.7871.47 or later by allowing Chrome's built-in auto-update to complete and fully relaunching the browser (updates do not take effect until restart), or push the fixed build via enterprise management (Google Update/ADMX policies). Verify per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires the user to load attacker-controlled HTML, effective interim compensating controls are to enforce Chrome's site isolation and sandbox (do not disable them), restrict browsing to trusted sites, and deploy web/URL filtering to block untrusted pages - with the trade-off of reduced browsing flexibility; disabling JavaScript would hinder the heap grooming needed but breaks most modern sites and is impractical as a broad control.