What is the CVSS score of CVE-2026-14113?

CVE-2026-14113 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14113?

A critical sandbox escape vulnerability in Google Chrome for Windows (versions before 150.0.7871.47) allows an attacker with an already-compromised browser renderer to break out of the sandbox and…. A patch is available.

How to fix or mitigate CVE-2026-14113?

Within 24 hours: Inventory Windows systems running Google Chrome and identify current versions in deployment. Within 7 days: Deploy Google Chrome version 150.0.7871.47 or later across all Windows systems using patch management or MDM. Within 30 days: Complete organizational compliance audit of Chrome versions and implement mandatory auto-update policies.

Google Chrome CVE-2026-14113

EUVD-2026-40800 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-7fhx-xxr5-6g2j

Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires first chaining a separate renderer compromise; UI:R for the crafted page; S:C and full C/I/A impact reflect the sandbox escape to higher privilege.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:25 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome for Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Updater component via a crafted HTML page to break out of the browser sandbox. It is a second-stage bug that Chromium rated only Low severity despite the CVSS 9.6 score, with no public exploit identified at time of analysis and a low EPSS probability of 0.18% (8th percentile). Google has shipped a fixed Stable-channel build.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Updater subsystem, the component responsible for keeping the browser up to date. Use-after-free bugs arise when memory is freed but a dangling pointer is subsequently reused, allowing an attacker to control freed-then-reallocated memory and corrupt program state. In Chromium's multi-process security architecture, untrusted web content runs inside a low-privilege renderer sandbox; escaping that sandbox to reach a higher-privileged component like the Updater is the class of bug being exploited here. Affected builds are the Windows desktop Chrome Stable channel prior to 150.0.7871.47; the EUVD advisory (EUVD-2026-40800) and Chrome release notes tie the fix to that version.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Windows via the Chrome Releases Stable Channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome normally auto-updates, so verify the running version under chrome://settings/help and relaunch to apply, and in managed fleets confirm your update policy is not pinning an older build. Because the flaw resides in the Updater component itself, do not disable Chrome's auto-update as a mitigation - that would keep users on the vulnerable code and remove the very mechanism that delivers the fix. Until the patched build is deployed, the practical compensating control is to reduce exposure of the necessary first stage (renderer compromise): keep Chrome fully current, enable Enhanced Safe Browsing to reduce the chance of a renderer-exploiting page, and restrict browsing of untrusted sites; note these lower but do not eliminate risk since a chained renderer bug is still the entry point.