What is the CVSS score of CVE-2026-14398?

CVE-2026-14398 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14398?

Google Chrome versions prior to 150.0.7871.46 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that allows remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-14398?

Within 24 hours: Inventory all Chrome deployments and identify systems running versions prior to 150.0.7871.46. Within 7 days: Deploy Chrome version 150.0.7871.46 or later organization-wide through your standard patch management process, prioritizing systems with high-sensitivity work and internet-facing roles. Within 30 days: Verify patch completion across all endpoints through telemetry and audit logs to confirm no systems remain unpatched.

Google Chrome CVE-2026-14398

EUVD-2026-41196 CRITICAL

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-jcwp-jr96-x94x

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs user interaction (UI:R); a use-after-free sandbox escape causes a scope change (S:C) with full memory-control impact across C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:27 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 150.0.7871.46 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page. Rated Critical by Chromium with a 9.6 CVSS score, the flaw is a use-after-free (CWE-416) requiring only that the target visit a malicious site. No public exploit or active exploitation is identified at time of analysis, and CISA's SSVC assessment lists exploitation as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses to translate WebGL and OpenGL ES calls to the platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). It runs in a highly-privileged position relative to the sandboxed renderer, making memory-corruption bugs in it valuable for sandbox escapes. The root cause is a use-after-free (CWE-416): memory is freed while a dangling reference remains reachable, so subsequent operations on that reference can be manipulated to corrupt heap state and gain code execution in the ANGLE/GPU context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop browser across versions before the fix.

RemediationAI

Vendor-released patch: 150.0.7871.46 - upgrade Google Chrome to 150.0.7871.46 or later on all desktop platforms and relaunch the browser to apply the update (Chrome auto-updates but requires a restart to complete). Verify via the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of Chromium-based browsers should apply their vendor's build incorporating the upstream fix. As an interim compensating control where immediate patching is not possible, restrict exposure by enforcing site isolation (default in Chrome) and consider disabling hardware-accelerated GPU/WebGL (chrome://settings - 'Use graphics acceleration when available'), which reduces the attack surface in ANGLE at the cost of degraded rendering performance and broken WebGL content; enterprise fleets can also deploy the update via managed policy to force the restart.