What is the CVSS score of CVE-2026-14403?

CVE-2026-14403 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14403?

Google Chrome desktop versions prior to 150.0.7871.46 contain a use-after-free vulnerability in the V8 JavaScript engine enabling remote code execution when users open crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-14403?

Within 24 hours, communicate the vulnerability and patch availability to Chrome administrators and IT stakeholders. Within 7 days, deploy Chrome 150.0.7871.46 or later across all desktop environments through auto-update mechanisms or enforced enterprise deployment. Within 30 days, audit patch compliance across all endpoints, document coverage metrics, and configure monitoring for any exploitation indicators tied to CVE-2026-14403.

Google Chrome CVE-2026-14403

EUVD-2026-41202 HIGH

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-5xh4-h2pm-54mv

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted page, low complexity, no auth, but requires the victim to open the page (UI:R); high C/I/A reflects in-sandbox code execution, though real impact is contained to V8.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:40 vuln.today

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution within the V8 sandbox affects Google Chrome desktop builds prior to 150.0.7871.46, where a use-after-free in the V8 JavaScript engine lets a remote attacker run code inside the sandbox when a victim opens a crafted HTML page. Google internally rated the Chromium security severity as Low and the execution is contained to the V8 sandbox rather than achieving a full renderer or OS escape. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC records no known exploitation.

Technical ContextAI

The flaw is a CWE-416 use-after-free in V8, the JavaScript and WebAssembly engine that Chrome (and all Chromium-derived browsers) uses to parse and JIT-compile untrusted script from web pages. A use-after-free occurs when the engine continues to reference a heap object after it has been freed, allowing an attacker who controls heap layout via crafted JavaScript to reclaim that memory and corrupt engine state, ultimately redirecting control flow. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop application; because the description explicitly limits impact to code execution 'inside a sandbox,' this targets the newer V8 heap sandbox / pointer-compression cage rather than a break out of the OS-level renderer sandbox.

RemediationAI

Vendor-released patch: 150.0.7871.46 - update Google Chrome to 150.0.7871.46 or later via the built-in updater (chrome://settings/help) and relaunch the browser to load the patched V8, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed fleets, push the update through your enterprise deployment channel (Group Policy/Chrome Browser Cloud Management, Jamf/Intune) and confirm the minimum version is enforced. Because exploitation requires the victim to render attacker-controlled HTML/JavaScript, interim compensating controls include disabling the V8 JIT via the JavaScriptJitAllowedForSites / site-isolation policies or the --js-flags='--jitless' hardening for high-risk users, which reduces the exploitable attack surface at the cost of degraded JavaScript performance on complex sites; URL filtering to block untrusted sites also lowers exposure but does not fully close the risk. SUSE-based systems (per the 'Suse' tag) should apply the distribution's Chromium update once published.