What is the CVSS score of CVE-2026-14397?

CVE-2026-14397 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14397?

Google Chrome for macOS versions prior to 150.0.7871.46 contain a critical sandbox escape vulnerability in the graphics layer.. A patch is available.

How to fix or mitigate CVE-2026-14397?

Within 24 hours: Inventory all macOS systems running Chrome versions prior to 150.0.7871.46. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all affected systems via MDM or enable auto-update. Within 30 days: Verify 100% deployment completion and review endpoint detection logs for exploitation signatures.

Google Chrome CVE-2026-14397

EUVD-2026-41183 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-01 Chrome

GHSA-xm69-pmf3-jr84

Buffer Overflow Google Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted HTML page (AV:N, PR:N) needs a victim visit (UI:R); a sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:27 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for macOS (versions prior to 150.0.7871.46) stems from an out-of-bounds write in ANGLE, the graphics abstraction layer that translates WebGL/OpenGL ES calls to native backends (Metal on Mac). A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU/graphics process to potentially break out of the renderer sandbox. There is no public exploit identified at time of analysis; Google rated the Chromium severity as Medium, and CISA's SSVC framework marks exploitation as none, though the CVSS base score is 9.6 due to the scope-changing sandbox-escape impact.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics translation library that maps WebGL and OpenGL ES commands onto the host's native graphics API - on macOS this is Metal. It processes attacker-influenceable geometry, shader, and texture data from web content, making it a recurring source of memory-safety bugs. The root cause is CWE-787 (Out-of-bounds Write): the code writes past the bounds of an allocated buffer, corrupting adjacent memory. Because ANGLE runs in a privileged graphics/GPU process rather than the tightly-confined renderer, controlled corruption here can be leveraged to escape the sandbox. The CPE (cpe:2.3:a:google:chrome) confirms the affected product is the Chrome application itself, specifically the macOS build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on macOS via the Stable channel (Chrome menu → About Google Chrome triggers auto-update, then relaunch), as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprises managing Chrome via MDM/policy should confirm the update has propagated and force a relaunch to apply it. As an interim compensating control before patching, restart the browser regularly to pick up staged updates and avoid untrusted web content that exercises WebGL/graphics; if an emergency mitigation is needed you can disable hardware-accelerated graphics/WebGL (chrome://settings → System → toggle off 'Use graphics acceleration', or via the WebGL policy) to reduce ANGLE attack surface, at the cost of degraded rendering and site-compatibility problems. These are stopgaps only - upgrading to the fixed version is the definitive fix.