What is the CVSS score of CVE-2026-14401?

CVE-2026-14401 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14401?

Google Chrome for Android (versions prior to 150.0.7871.46) contains a sandbox escape vulnerability in its ANGLE graphics component that could allow attackers who have compromised the browser…. A patch is available.

How to fix or mitigate CVE-2026-14401?

Within 24 hours: Verify current Chrome versions deployed across Android fleet. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all Android devices via mobile device management (MDM) or enforce app store auto-updates. Within 30 days: Confirm 100% patch deployment completion and review device logs for exploitation indicators.

Google Chrome CVE-2026-14401

EUVD-2026-41164 HIGH

Improper Input Validation (CWE-20)

2026-07-01 Chrome

GHSA-3x3p-qx4r-hmgh

Information Disclosure Google Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remotely reachable via web content but AC:H and UI:R reflect the required renderer compromise and page visit; S:C and C/I/A:H capture the full sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:26 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

8.3 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component on Android (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, the flaw stems from improper validation of untrusted input in ANGLE and requires renderer compromise plus user interaction as prerequisites. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's abstraction layer that translates OpenGL ES / WebGL calls into the platform's native graphics API (on Android, typically Vulkan or OpenGL ES via the GPU). Because ANGLE processes GPU commands originating from web content, it sits at a trust boundary between the sandboxed renderer and the more privileged GPU/browser process. The root cause is CWE-20 (Improper Input Validation): ANGLE insufficiently validates untrusted input, so malformed or crafted graphics commands from a compromised renderer can be processed in a way that crosses the sandbox boundary. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected application, with the description narrowing the impacted platform to Android builds before 150.0.7871.46.

RemediationAI

Update Google Chrome to version 150.0.7871.46 or later (Vendor-released patch: 150.0.7871.46), which is distributed automatically through the Chrome stable channel and the Google Play Store on Android; verify via chrome://settings/help and restart the browser to apply. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and the Chromium tracking bug (https://issues.chromium.org/issues/513048822). Because exploitation requires a compromised renderer, interim risk can be reduced by ensuring auto-updates are enabled and by avoiding untrusted sites; for higher-assurance environments, disabling WebGL/hardware acceleration reduces ANGLE's attack surface at the cost of degraded graphics performance and broken WebGL content, but the definitive remediation is upgrading to the patched build.