What is the CVSS score of CVE-2026-14407?

CVE-2026-14407 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-14407?

Google Chrome CVE-2026-14407 allows remote code execution when users encounter malicious webpages, affecting all end-users running desktop Chrome versions prior to 150.0.7871.46.. A patch is available.

How to fix or mitigate CVE-2026-14407?

Within 24 hours, use endpoint detection tools to identify Chrome versions below 150.0.7871.46 and assess the affected user count; notify IT stakeholders of patching requirements. Within 7 days, deploy Chrome 150.0.7871.46 or later organization-wide using your standard patch management system, prioritizing users in high-risk roles; enable automatic updates if not currently enforced. Within 30 days, verify through MDM/endpoint telemetry that 95% or greater of Chrome desktop installations have reached version 150.0.7871.46 or later and document remediation status.

Google Chrome CVE-2026-14407

EUVD-2026-41160 HIGH

Buffer Overflow (CWE-119)

2026-07-01 Chrome

GHSA-6pr3-grcv-9x6m

RCE Buffer Overflow Google Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no privileges but required user interaction (UI:R); high renderer-process impact with scope unchanged since execution stays inside the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:44 vuln.today

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution within the renderer sandbox affects Google Chrome desktop versions prior to 150.0.7871.46, where an inappropriate implementation flaw in the V8 JavaScript engine lets a remote attacker run code confined to the browser sandbox after a victim opens a crafted HTML page. Google rated the Chromium severity as Medium, and the code execution is explicitly described as occurring inside the sandbox rather than as a full sandbox escape. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV, with a low EPSS score of 0.28% (20th percentile).

Technical ContextAI

The flaw resides in V8, the C++ JavaScript and WebAssembly engine that compiles and executes untrusted script from every web page Chrome loads. Classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), the root cause is a memory-safety error - consistent with the 'Buffer Overflow' tag - where V8 mishandles memory during script execution, allowing an attacker-controlled page to corrupt memory and gain control of execution flow. Per the CPE (cpe:2.3:a:google:chrome), the affected component is the desktop Chrome browser; because V8 runs inside the renderer process, the resulting code execution is contained by Chrome's multi-process sandbox and does not by itself grant host-level access.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on all desktop platforms, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); most installs update automatically, but verify via chrome://settings/help and relaunch to complete the update, and push the update through enterprise management (Chrome Browser Cloud Management/GPO) for managed fleets. Users of downstream repackaged builds (e.g., the Suse/openSUSE Chromium package) should apply the corresponding distribution update once published. As an interim compensating control before patching, limit exposure by having users avoid untrusted sites and consider enabling stricter site isolation or the enterprise policy to restrict JavaScript on untrusted origins - with the trade-off that disabling JavaScript broadly breaks most modern web applications; there is no reliable non-patch mitigation for a V8 memory bug short of not rendering attacker-controlled pages.