What is the CVSS score of CVE-2026-14151?

CVE-2026-14151 has a contested CVSS base score of 8.3 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-14151?

Google Chrome desktop (versions before 150.0.7871.47) contains a sandbox escape vulnerability that allows attackers who have already compromised the renderer process to gain full system access.. A patch is available.

How to fix or mitigate CVE-2026-14151?

Within 24 hours: Inventory Chrome deployments and verify patch delivery mechanisms are functional. Within 7 days: Deploy Google Chrome version 150.0.7871.47 or later to all endpoints; enable automatic updates. Within 30 days: Audit patch compliance to ensure no systems remain below version 150.0.7871.47.

Google CVE-2026-14151

EUVD-2026-40838 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-06-30 chrome-cve-admin@google.com

GHSA-j3wx-vg3q-5r45

Information Disclosure Google Red Hat Suse

High

Disputed · 8.3 Vendor: google

Severity by source

Sources disagree (Low–High)

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the required prior renderer compromise plus a crafted page; PR:N because no OS privileges are needed; S:C with C/I/A:H for a full sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 01, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 01, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 01, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL) 8.3 (HIGH)

Analysis Generated

Jul 01, 2026 - 14:30 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the security sandbox using a crafted HTML page, elevating from a contained renderer to broader host access. Rooted in CWE-669 (incorrect resource transfer between spheres) within Chrome's AI component, it carries a CVSS 8.3 (scope-changed) rating despite Google's own 'Low' Chromium severity, reflecting the fact that it is a second-stage escape rather than a standalone entry point. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%, 7th percentile), and it is not listed in CISA KEV.