What is the CVSS score of CVE-2026-14122?

CVE-2026-14122 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14122?

Google Chrome versions before 150.0.7871.47 on Windows are vulnerable to memory corruption attacks through crafted web pages, potentially allowing attackers to exfiltrate user data and credentials…. A patch is available.

How to fix or mitigate CVE-2026-14122?

Within 24 hours, identify all Windows systems running Chrome and communicate patch requirements to stakeholders. Within 7 days, deploy Chrome 150.0.7871.47 or later via your patch management system or enable automatic updates. Within 30 days, audit all Chrome installations to confirm patching completion and establish ongoing vulnerability monitoring for future Chrome security updates.

Google Chrome CVE-2026-14122

EUVD-2026-40809 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-786v-2h39-2p26

Information Disclosure Google Microsoft Red Hat

High

Disputed · 8.1 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote crafted page requires the user to visit it (UI:R) with no auth (PR:N); arbitrary read/write yields high C and I but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:12 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.1

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Arbitrary read/write in Google Chrome on Windows (versions prior to 150.0.7871.47) allows a remote attacker to corrupt or exfiltrate in-process memory when a victim visits a crafted HTML page, stemming from insufficient input validation in the WebAppInstalls component. The CVSS 8.1 rating reflects high confidentiality and integrity impact requiring only user interaction (visiting a page), though Chromium rated the underlying security severity as Low. There is no public exploit identified at time of analysis, EPSS is a low 0.18% (8th percentile), and CISA SSVC marks exploitation as none, indicating high theoretical impact but currently low real-world exploitation pressure.

Technical ContextAI

The flaw lives in Chrome's WebAppInstalls subsystem, the browser machinery that handles installation and management of Progressive Web Apps / installable web applications. The root cause is CWE-20 (Improper Input Validation): untrusted data delivered through a crafted HTML page is not adequately validated before use, enabling out-of-bounds or otherwise unintended arbitrary read and write operations within the affected process. The affected CPE is cpe:2.3:a:google:chrome, and the defect is platform-specific to the Windows build of Chrome. Because the primitive is arbitrary read/write, it is the type of memory-safety weakness that can, in principle, be chained toward information disclosure or further memory corruption, which aligns with the 'Information Disclosure' tag applied to this record.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Windows via the Chrome Stable Channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; on managed fleets, ensure Chrome auto-update is enabled or push the update through your management tooling and force a browser relaunch so the new binary loads. Because the affected component is WebAppInstalls, an interim compensating control is to restrict or disable web app installation via enterprise policy (e.g., the WebAppInstallForceList / blocking user-initiated PWA installs) to reduce exposure of that code path, accepting the trade-off that users lose the ability to install PWAs. As a broader hardening measure, discourage browsing untrusted sites on unpatched builds, but this is only a stopgap - patching to 150.0.7871.47 is the definitive fix.