What is the CVSS score of CVE-2026-14133?

CVE-2026-14133 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-14133?

Yes, a patch is available for CVE-2026-14133. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-14133

EUVD-2026-40820 MEDIUM

Race Condition (CWE-362)

2026-06-30 chrome-cve-admin@google.com

GHSA-24q4-mvc8-82fw

Information Disclosure Race Condition Google Suse Red Hat

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Race condition demands precise timing (AC:H); UI spoofing yields only partial C/I impact with no availability effect, no scope change, and no privilege requirement.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:26 vuln.today

CVSS changed

Jul 01, 2026 - 16:07 NVD

4.2 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 nvd

MEDIUM 4.2

DescriptionNVD

Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's History Embeddings subsystem, which generates machine-learning-based embedding representations of browsing history to power features such as address bar suggestions and semantic search. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) identifies the root cause as a classic race condition: two or more threads compete over shared embedding or UI state without proper locking, and an attacker-controlled HTML page can influence the timing of that contention to corrupt UI rendering in an unintended way. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome platform variants prior to version 150.0.7871.47. Google's own internal severity classification for this issue is 'Low', consistent with the constrained impact scope.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this race condition, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism handles this transparently for most consumer installations - users should verify their version via chrome://settings/help. For enterprise environments managing Chrome via policy (Google Admin Console, Intune, or similar MDM), push the stable channel update to enforce the minimum version. No documented workarounds exist; given the low severity, UI-only impact scope, and absence of active exploitation, compensating controls are not warranted - standard update cadence is the appropriate response.