What is the CVSS score of CVE-2026-14118?

CVE-2026-14118 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-14118?

Yes, a patch is available for CVE-2026-14118. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14118

EUVD-2026-40805 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-j39g-274j-3wpm

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable via crafted page, no privileges needed, but active UI gestures required; confidentiality-only impact with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:36 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionNVD

Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.

Technical ContextAI

The vulnerability resides in Chrome's DevTools subsystem, the browser-embedded developer tooling exposed to the renderer process. CWE-20 (Improper Input Validation) identifies the root cause: DevTools fails to sufficiently validate data when handling input from a crafted page, allowing a bypass of the Same-Origin Policy (SOP) - the browser security boundary that prevents scripts at one origin from reading resources belonging to a different origin. The flaw is specific to how DevTools processes data in response to user-initiated gestures, suggesting the validation gap sits at the interface between DevTools instrumentation and page-controlled content. Affected product confirmed by EUVD CPE data as Chrome versions below 150.0.7871.47 across all desktop platforms. The upstream Chromium issue is tracked at issues.chromium.org/issues/513772764.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later, which is the vendor-released patch addressing this vulnerability (stable channel update, https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Chrome auto-updates by default for consumer installs; enterprise administrators using Group Policy or managed deployments (e.g., Google Admin Console, Intune) should verify the updated version is deployed fleet-wide. No workarounds have been identified in available references. Because exploitation requires specific user UI gestures on a crafted page, user awareness about unsolicited or suspicious page interactions provides marginal additional defense, but patching remains the only confirmed fix.