What is the CVSS score of CVE-2026-14152?

CVE-2026-14152 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-14152?

A critical vulnerability in Google Chrome's graphics rendering engine (versions prior to 150.0.7871.47) could allow attackers to escalate privileges within already-compromised browser processes,…. A patch is available.

How to fix or mitigate CVE-2026-14152?

Within 24 hours: Verify Chrome auto-update settings are enabled in your environment and identify any instances with manual deployment. Within 7 days: Push Chrome 150.0.7871.47 or later through your patch management system to all endpoints. Within 30 days: Audit deployment logs to confirm patch coverage and address any Chrome instances still running versions prior to 150.0.7871.47.

Google CVE-2026-14152

EUVD-2026-40839 CRITICAL

Out-of-bounds Write (CWE-787)

2026-06-30 chrome-cve-admin@google.com

GHSA-hc37-v37p-g4x2

Buffer Overflow Google Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Low–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:31 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the renderer sandbox via a crafted HTML page. The flaw is a CWE-787 out-of-bounds read and write; Google's own Chromium team rated the security severity as Low, and there is no public exploit identified at time of analysis. EPSS estimates only a 0.17% (7th percentile) chance of exploitation, and the vulnerability is not listed in CISA KEV.