What is the CVSS score of CVE-2026-14392?

CVE-2026-14392 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14392?

Google Chrome Desktop contains a critical sandbox escape vulnerability (CVE-2026-14392, CVSS 9.6) that allows remote attackers to execute arbitrary code through a crafted HTML page.. A patch is available.

How to fix or mitigate CVE-2026-14392?

Within 24 hours: Issue urgent communication to all users regarding the vulnerability; confirm Chrome 150.0.7871.46+ availability and establish deployment timeline. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all organization-managed endpoints; communicate deadline to users on self-managed devices. Within 30 days: Verify patch deployment across all systems and establish monitoring to detect any remaining vulnerable versions in the environment.

Google Chrome CVE-2026-14392

EUVD-2026-41185 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-01 Chrome

GHSA-3gwq-6p88-8h45

Buffer Overflow Google Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote, low-complexity, unauthenticated but requires visiting a page (UI:R); the memory-corruption sandbox escape crosses the renderer trust boundary (S:C) with total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:28 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Tint WebGPU shader compiler affects all Desktop builds prior to 150.0.7871.46, where a crafted HTML page triggers an out-of-bounds write (CWE-787) that a remote attacker can leverage to break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, the flaw carries a CVSS 9.6 due to its scope-changing memory-corruption impact, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is already available, so the practical priority is rapid browser updating rather than emergency mitigation.

Technical ContextAI

Tint is the shader-language compiler inside Chrome's Dawn/WebGPU stack that translates WGSL (WebGPU Shading Language) supplied by web content into the intermediate and backend representations used by the GPU. Because WebGPU exposes this compilation path to untrusted JavaScript/HTML, a malformed shader or GPU workload can reach parsing/codegen logic in Tint. The root cause is classified as CWE-787 (Out-of-bounds Write): the compiler writes past the bounds of an allocated buffer, corrupting adjacent memory. The affected component identified by CPE cpe:2.3:a:google:chrome is the Chrome desktop browser; the scope-change flag (S:C) in the CVSS vector reflects that a successful write in the sandboxed renderer/GPU process can be chained into a sandbox escape, crossing the trust boundary Chrome relies on to contain web content.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on all Desktop platforms; the fix is delivered via the Stable Channel update announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html, and users should relaunch the browser to apply it (verify via chrome://settings/help). For managed fleets, push the updated build through enterprise update policies and confirm the minimum version. Where immediate updating is not possible, a targeted compensating control is to disable WebGPU (turn off the 'Unsafe WebGPU' flag at chrome://flags and, on managed devices, the WebGPU-related enterprise policies) to remove access to the vulnerable Tint compilation path; the trade-off is that WebGPU-dependent web applications will lose acceleration or fail to function. Restricting browsing to trusted sites and keeping site isolation enabled (default) further limits exposure until the update is deployed.