What is the CVSS score of CVE-2026-14111?

CVE-2026-14111 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14111?

Google Chrome's WebProtect component (versions prior to 150.0.7871.47) contains a use-after-free vulnerability enabling arbitrary code execution if users install a malicious extension.. A patch is available.

How to fix or mitigate CVE-2026-14111?

Within 24 hours, identify Chrome deployment scope across your organization and review extension governance policies. Over the next 7 days, deploy Chrome version 150.0.7871.47 or later to all systems through your standard update mechanism, prioritizing devices used by high-value users and those with administrative privileges. Within 30 days, conduct a full audit of installed extensions enterprise-wide, revoke or sandbox any extensions not explicitly authorized, and implement mandatory security training on extension risk for end users.

Google Chrome CVE-2026-14111

EUVD-2026-40798 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-9wj7-crvx-83v4

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.1 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires the victim to install a malicious extension (UI:R) and winning a use-after-free race (AC:H); no prior privileges needed (PR:N), and successful RCE yields total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:15 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.1

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution in Google Chrome's WebProtect component (versions prior to 150.0.7871.47) arises from a use-after-free (CWE-416) that a malicious Chrome extension can trigger to run attacker-controlled code. Exploitation is gated behind convincing a victim to install a crafted extension, and Chromium rated the security severity as Low despite the NVD CVSS of 8.1. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile).

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's WebProtect functionality, part of the Chromium browser engine used across Chrome and Chromium-derived browsers (SUSE packaging is referenced in the tags). A use-after-free occurs when a pointer to freed heap memory is dereferenced, allowing an attacker who controls subsequent heap allocations to place attacker-influenced data where the freed object was, corrupting memory and potentially achieving control-flow hijack. The affected CPE is cpe:2.3:a:google:chrome (all versions below the fixed build), and the attack surface is reached through the extension API rather than ordinary web content.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; the update is delivered automatically but should be forced by restarting the browser or triggering an update check, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Downstream users (e.g. SUSE and other Chromium-based distributions) should apply their vendor's corresponding package update. Because exploitation depends entirely on a malicious extension, the most effective compensating control is enterprise extension management: enforce an extension allowlist via Chrome policy (ExtensionInstallAllowlist/ExtensionInstallBlocklist) and disable developer-mode sideloading, which prevents users from installing untrusted CRX files at the cost of blocking unvetted extensions. Restricting extension installation to the Chrome Web Store and disabling external extension loading further reduces exposure.