What is the CVSS score of CVE-2026-14411?

CVE-2026-14411 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14411?

Google Chrome versions before 150.0.7871.46 contain a critical vulnerability that allows attackers to compromise employee systems through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-14411?

Within 24 hours: Inventory all Chrome installations and versions across the organization, identifying systems running versions below 150.0.7871.46; establish testing and deployment timeline. Within 7 days: Deploy and validate Google Chrome 150.0.7871.46 or later in test environments for stability verification. Within 30 days: Complete enterprise-wide rollout of Google Chrome 150.0.7871.46 or later to all systems.

Google Chrome CVE-2026-14411

EUVD-2026-41166 CRITICAL

Improper Input Validation (CWE-20)

2026-07-01 Chrome

GHSA-8jr8-cv4x-4jmv

Information Disclosure Google Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges but requires the victim to load it (UI:R); a sandbox escape crosses the security authority boundary (S:C) with high CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:25 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component before 150.0.7871.46 lets a remote attacker break out of the renderer sandbox when a victim loads a malicious web page. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE and carries a CVSS 9.6 due to scope change and full CIA impact, though exploitation requires the user to visit attacker-controlled content. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with SSVC exploitation status assessed as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls into the platform's native graphics API (Direct3D, Metal, Vulkan, or desktop OpenGL). Because ANGLE processes GPU commands driven by web content such as WebGL, it sits at a trust boundary between the sandboxed renderer and the more-privileged GPU process. The root cause is CWE-20 (Improper Input Validation): untrusted, attacker-influenced graphics input is not adequately validated, which per the description can be leveraged toward a sandbox escape. The affected CPE is cpe:2.3:a:google:chrome, indicating the desktop Chrome browser across platforms that ship ANGLE.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel, and on managed fleets force the browser to relaunch so the update actually applies, since Chrome only completes the update after a restart. Refer to the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue at https://issues.chromium.org/issues/513919827. If patching must be delayed, reduce exposure by restricting untrusted browsing and, as a targeted control, disabling hardware-accelerated WebGL/GPU rendering (for example via the disable-3d-apis or hardware-acceleration enterprise policy) to cut off the ANGLE attack surface, with the trade-off being degraded rendering and performance for graphics-heavy sites. Also ensure Chromium-based derivatives that embed the same ANGLE build are updated once their upstream merges land.