Google Chrome CVE-2026-14409

Exploitation requires the victim to load an attacker-controlled crafted HTML page in Chrome AND to perform specific UI gestures on that page (UI:R) - the interaction is not incidental, so the attacker must socially engineer or trick the user into deliberate actions. High attack complexity (AC:H) means the trigger depends on precise conditions rather than a trivial payload. No authentication is required (PR:N, remote unauthenticated delivery), but code execution is confined to the renderer sandbox - this vulnerability alone does not yield host-level compromise without a separate sandbox-escape bug. Limiting factors: mandatory user interaction, high complexity, sandbox containment, and requirement that the target run a Chrome version older than 150.0.7871.46.

The signals are notably divergent and should temper the raw 7.5 CVSS score. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) already reflects meaningful friction: high attack complexity plus required user interaction in the form of 'specific UI gestures', which is harder to achieve than a simple page visit. Google/Chromium rated the security severity 'Low' despite CVSS C:H/I:H/A:H, because execution is confined to the sandbox - the C/I/A high ratings appear to describe impact within the renderer, not a full host compromise, so treat the 7.5 as an overstatement of real-world consequence. EPSS is low (0.25%), CISA SSVC shows Exploitation: none and Automatable: no, and no POC or KEV entry exists, all reinforcing low near-term risk. The one elevating factor is SSVC Technical Impact: total, but combined with 'none/no' this reads as a serious-if-exploited but currently-not-exploited issue - patch on normal cadence rather than emergency.

An attacker hosts a crafted HTML page and uses phishing or a malicious ad to draw a victim to it, then leads the user through specific on-page UI gestures (the required interaction) that trigger the V8 implementation flaw. Once triggered, attacker-controlled code executes inside the Chrome renderer sandbox, giving the attacker control over that page's context and a foothold for further sandbox-escape chaining. No public exploit is identified at time of analysis, and the high attack complexity plus needed interaction make opportunistic mass exploitation unlikely.