What is the CVSS score of CVE-2026-14409?

CVE-2026-14409 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14409?

A critical arbitrary code execution vulnerability in Google Chrome (versions prior to 150.0.7871.46) enables attackers to execute code within the renderer sandbox through a crafted webpage requiring…. A patch is available.

How to fix or mitigate CVE-2026-14409?

Within 24 hours, audit your organization's Chrome deployment across all endpoints and identify critical user populations (developers, system administrators, finance and legal staff with sensitive data access). Within 7 days, begin staged rollout of Chrome version 150.0.7871.46 or later using your enterprise patch management system, starting with high-risk user segments and communicating patching urgency to all teams. Within 30 days, achieve 95%+ patch compliance across all Chrome installations and conduct post-deployment verification through endpoint management tools to confirm no unpatched instances remain in production environments.

Google Chrome CVE-2026-14409

EUVD-2026-41161 HIGH

Improper Privilege Management (CWE-269)

2026-07-01 Chrome

GHSA-mgc2-25xq-j88c

Privilege Escalation RCE Google Red Hat

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.0 MEDIUM

Network-delivered but AC:H and UI:R for the required specific gestures; impact reduced to Low because code runs contained in the renderer sandbox with no scope change to the host.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:44 vuln.today

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 7.5

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution within the renderer sandbox affects Google Chrome desktop builds prior to 150.0.7871.46, stemming from an inappropriate implementation in the V8 JavaScript engine. A remote attacker who lures a user to a crafted HTML page and convinces them to perform specific UI gestures can run attacker-controlled code inside the sandboxed renderer process. There is no public exploit identified at time of analysis, EPSS is low (0.25%, 16th percentile), and CISA SSVC records no observed exploitation, though the technical impact is rated total.

Technical ContextAI

The flaw lies in V8, the Chromium/Chrome JavaScript and WebAssembly engine that JIT-compiles and executes untrusted script from any visited web page. An 'inappropriate implementation' in V8 means the engine's logic diverges from its intended security model rather than a classic memory-corruption bug, and it is classified under CWE-269 (Improper Privilege Management), consistent with the 'Privilege Escalation' tag - the code executes with more capability than script should have, but critically remains inside the renderer sandbox rather than escaping to the host. The affected component matches CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome application across platforms, and the same engine underpins other Chromium-based browsers even though this advisory scopes only Google Chrome.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.46 or later - update via the Chrome Stable channel and restart the browser to apply it, per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprises should push the update through their managed browser/MDM channel and confirm auto-update is not disabled; SUSE/Chromium-based distribution users should apply the corresponding distro package update. As an interim compensating control given the requirement for user-driven UI gestures on a malicious page, restrict browsing to trusted sites and enforce user awareness against performing unusual prompted interactions on untrusted pages; there is no need to disable JavaScript broadly (which would break most sites) since prompt patching resolves the issue and no active exploitation is observed.