What is the CVSS score of CVE-2026-14387?

CVE-2026-14387 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-14387?

All Google Chrome users on company desktops face critical risk of host-level compromise from visiting malicious websites, due to a sandbox escape vulnerability (CVE-2026-14387, CVSS 9.6) in versions…. A patch is available.

How to fix or mitigate CVE-2026-14387?

Within 24 hours: Inventory Chrome deployments and communicate critical patch advisory to all users; prepare Chrome 150.0.7871.46 or later for distribution. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all affected desktops via your patch management system. Within 30 days: Verify 100% patch compliance through endpoint telemetry and review security logs for exploitation attempts.

Google CVE-2026-14387

EUVD-2026-41172 CRITICAL

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-07-01 Chrome

GHSA-7jh2-m4p8-4gp3

Buffer Overflow Google Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:30 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library affects all desktop builds prior to 150.0.7871.46, where an integer overflow triggered by a crafted HTML page can break out of the renderer sandbox into the more-privileged browser process. A remote attacker who lures a victim to a malicious page could potentially compromise the host beyond the rendering sandbox. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory Chrome deployments and communicate critical patch advisory to all users; prepare Chrome 150.0.7871.46 or later for distribution. …

Threat intelligence, references, and detailed analysis are available after sign-in.