What is the CVSS score of CVE-2026-14119?

CVE-2026-14119 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-14119?

Yes, a patch is available for CVE-2026-14119. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14119

EUVD-2026-40806 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-30 chrome-cve-admin@google.com

GHSA-m8qw-rfh7-66f9

Information Disclosure Google Memory Corruption Microsoft Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:A confirmed by Bluetooth adjacency; PR:N because no auth needed; C:H for process memory leakage; I and A remain N as no write or crash impact described.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:42 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)

AnalysisAI

Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.

Technical ContextAI

CWE-843 (Type Confusion) describes a flaw where code allocates or accesses a resource using one type but then handles it as an incompatible type, allowing out-of-bounds or unintended memory reads. Here the flaw resides in Google Chrome's Bluetooth subsystem on the Windows platform specifically. Bluetooth operates as an adjacent-network protocol (IEEE 802.15 family), meaning the attacker must be within Bluetooth radio range - typically 10-100 meters depending on device class. The CVSS vector AV:A confirms this adjacency constraint. The affected version range per EUVD is any Chrome release below 150.0.7871.47 on Windows. The Chromium bug tracker reference (issues.chromium.org/issues/513775483) likely contains additional technical detail but may be access-restricted until broader patch adoption.

RemediationAI

Upgrade Google Chrome on Windows to version 150.0.7871.47 or later - this is the vendor-released patch confirmed via the Chrome stable channel blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should deliver this update automatically; administrators managing enterprise deployments should verify via chrome://version or group policy reporting. As a compensating control for environments that cannot patch immediately, disabling Bluetooth at the OS level on Windows systems running Chrome eliminates the adjacent-attack surface entirely, with the trade-off of losing Bluetooth peripheral functionality. Alternatively, enforcing that Bluetooth is off in high-security areas (conference rooms, open offices near public spaces) reduces physical exposure. No workaround exists within Chrome itself since the flaw is in the Bluetooth stack integration.