What is the CVSS score of CVE-2026-14120?

CVE-2026-14120 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14120?

Google Chrome versions prior to 150.0.7871.47 contain a critical sandbox escape vulnerability in the DevTools component that could allow attackers who have compromised a browser process to gain full…. A patch is available.

How to fix or mitigate CVE-2026-14120?

Within 24 hours, inventory Chrome installations across the organization to identify systems running versions prior to 150.0.7871.47 and assess distribution infrastructure readiness. Within 7 days, deploy Chrome version 150.0.7871.47 or later to all user endpoints using your browser management solution or mobile device management platform. Within 30 days, verify complete rollout by confirming zero vulnerable versions through endpoint telemetry and centralized device management console audits.

Google Chrome CVE-2026-14120

EUVD-2026-40807 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-rjcx-5j87-vp95

Information Disclosure Google Red Hat

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-existing renderer compromise plus a crafted page; S:C and C/I/A:H reflect a full sandbox escape reaching the host, consistent with Google's Low rating on precondition grounds.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:13 vuln.today

CVE Published

Jun 30, 2026 - 23:17 nvd

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's DevTools component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox and reach the host via a crafted HTML page. Google's Chromium security team rated this Low severity because it is a second-stage bug requiring prior renderer compromise, which conflicts sharply with the NVD CVSS 9.6 (Critical); no public exploit is identified at time of analysis, KEV/SSVC show no known exploitation, and EPSS is low at 0.18%. A vendor patch is available.

Technical ContextAI

The flaw lives in Chrome DevTools, the built-in debugging and instrumentation surface of the Chromium browser engine, which is privileged relative to web content and interacts across the renderer/browser process boundary that Chrome's multi-process sandbox is designed to enforce. The root cause is classified as CWE-693 (Protection Mechanism Failure): an 'inappropriate implementation' means a security boundary - here the renderer sandbox - is not correctly enforced, so code already running in a compromised renderer can misuse DevTools behavior to cross into higher-privileged territory. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application itself across platforms, consistent with the Chromium codebase shared by Chrome desktop builds.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the stable channel; the fix is published in Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Because Chrome auto-updates, ensure the browser is fully closed and relaunched so the update applies, and in managed fleets push the pinned version through enterprise policy (GPO/MDM) rather than relying on per-user updates. There is no standalone configuration workaround for the DevTools defect itself; as compensating controls until patched, prioritize the upstream defense - reduce the likelihood of the required renderer compromise by keeping Chrome current, enabling Site Isolation (default) and the strictest sandbox, and restricting untrusted browsing - and where policy permits, disabling DevTools via the DeveloperToolsAvailability enterprise policy reduces attack surface at the cost of breaking legitimate developer/debugging workflows. Downstream SUSE users should track their distribution's Chromium advisory.