What is the CVSS score of CVE-2026-14387?

CVE-2026-14387 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by CVE-2026-14387?

All Google Chrome users on company desktops face critical risk of host-level compromise from visiting malicious websites, due to a sandbox escape vulnerability (CVE-2026-14387, CVSS 9.6) in versions…. A patch is available.

How to fix or mitigate CVE-2026-14387?

Within 24 hours: Inventory Chrome deployments and communicate critical patch advisory to all users; prepare Chrome 150.0.7871.46 or later for distribution. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all affected desktops via your patch management system. Within 30 days: Verify 100% patch compliance through endpoint telemetry and review security logs for exploitation attempts.

Google CVE-2026-14387

EUVD-2026-41172 CRITICAL

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-07-01 Chrome

GHSA-7jh2-m4p8-4gp3

Buffer Overflow Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

6.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:30 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library affects all desktop builds prior to 150.0.7871.46, where an integer overflow triggered by a crafted HTML page can break out of the renderer sandbox into the more-privileged browser process. A remote attacker who lures a victim to a malicious page could potentially compromise the host beyond the rendering sandbox. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none'.