What is the CVSS score of CVE-2026-14121?

CVE-2026-14121 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14121?

Google Chrome Remote Desktop (Chromoting) on Linux contains a remote code execution vulnerability via memory corruption (CVE-2026-14121) that could allow attackers to execute arbitrary commands…. A patch is available.

How to fix or mitigate CVE-2026-14121?

Within 24 hours: Identify all Linux systems running Chrome Remote Desktop and determine which are Internet-accessible or used for critical administration. Within 7 days: Deploy Chrome version 150.0.7871.47 or later to all affected Linux systems, prioritizing externally accessible instances. Within 30 days: Verify 100% patch coverage across all Chromoting deployments and implement firewall rules restricting Chrome Remote Desktop access to authorized administrative networks only.

Google Chrome CVE-2026-14121

EUVD-2026-40808 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-h55x-prmc-8cvx

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

Critical

Disputed · 9.8 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote but requires an active Chrome Remote Desktop session (UI:R) and reliable heap grooming of a use-after-free (AC:H); full RCE keeps C/I/A High.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 18:50 vuln.today

Severity Changed

Jul 02, 2026 - 16:37 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 16:37 NVD

8.1 (HIGH) 9.8 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux, fixed in 150.0.7871.47, lets a remote attacker corrupt memory via crafted network traffic and potentially run arbitrary code. The flaw is a CWE-416 use-after-free reported by Google's internal Chrome security team; there is no public exploit identified at time of analysis and it is not in CISA KEV. Note a signal conflict: NVD scores this 9.8 (Critical) while Chromium itself rated the security severity 'Low', and EPSS is only 0.20% (10th percentile).

Technical ContextAI

The defect lives in Chromoting, the code path behind Chrome Remote Desktop, which brokers remote screen/input sessions over the network. The root cause is CWE-416 (use-after-free): the component references heap memory after it has been freed, so an attacker who can influence the timing or content of session network traffic can cause a dangling pointer to be reused, corrupting the heap. Successful heap grooming of a use-after-free in a browser process can escalate from a crash to control of program flow and arbitrary code execution. The CPE identifies the affected software as cpe:2.3:a:google:chrome (Linux builds specifically, per the description).

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 (Stable channel for desktop) - upgrade Linux Chrome to 150.0.7871.47 or later and restart the browser to load the update, per the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because the fix ships through Chrome's normal auto-update, verify that managed/enterprise deployments have not pinned an older version and force a channel update where they have. As an interim compensating control until the update is applied, disable or uninstall the Chrome Remote Desktop / Chromoting functionality (the sole affected code path) and block or restrict inbound Chrome Remote Desktop connections at the network layer; the trade-off is loss of remote-desktop access for users who rely on it. Given SSVC exploitation 'none', low EPSS, and Chromium's 'Low' rating, standard patch timelines are acceptable rather than emergency out-of-band action.