What is the CVSS score of CVE-2026-14413?

CVE-2026-14413 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14413?

Google Chrome versions prior to 150.0.7871.46 contain a sandbox escape vulnerability that enables attackers to escalate privileges and gain broader system access if the browser is initially…. A patch is available.

How to fix or mitigate CVE-2026-14413?

24 hours: Inventory Chrome versions deployed across all endpoints and identify systems in high-risk roles. 7 days: Deploy Chrome 150.0.7871.46 or later organization-wide using your standard patch management process; prioritize systems handling sensitive data or used by privileged users. 30 days: Verify 100% patch deployment completion, review browser process execution logs for anomalies, and assess whether enhanced endpoint detection monitoring should be enabled.

Google Chrome CVE-2026-14413

EUVD-2026-41191 HIGH

Use of Uninitialized Variable (CWE-457)

2026-07-01 Chrome

GHSA-6p8q-f9vc-4mp9

Information Disclosure Google Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network-delivered crafted page with unreliable trigger (AC:H) and user interaction (UI:R); requires prior renderer control so PR:L, and escaping the sandbox is a scope change (S:C) with total impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:24 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

8.3 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.3

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.46) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is an uninitialized-memory use (CWE-457) in ANGLE, reported by Google's own Chrome team and fixed in the June 2026 Stable channel update. No public exploit is identified at time of analysis, and CISA's SSVC framework records exploitation status as none, but the total technical impact and sandbox-escape nature make it a high-priority browser patch.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction that translates WebGL and OpenGL ES calls onto the host's native backend (Direct3D, Metal, Vulkan, or desktop GL). It runs in a more privileged GPU/browser context than the sandboxed renderer, which makes memory-safety bugs in ANGLE a classic sandbox-escape surface. The root cause is CWE-457 (Use of Uninitialized Variable): ANGLE consumes memory that was never initialized, producing undefined behavior an attacker can steer. Per the CPE data (cpe:2.3:a:google:chrome), all Chrome builds before 150.0.7871.46 are affected, and because ANGLE is shared across Chromium-derived browsers, downstream products (Edge, Brave, Opera, Electron apps) typically inherit the same defect until they rebase.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on all desktop platforms; verify via chrome://settings/help and fully relaunch the browser so the ANGLE component reloads, since the fix is only active after restart. In managed fleets, force the update through enterprise policy/MDM and confirm rollout, as ANGLE bugs cannot be mitigated through browser preferences. Reference the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and Chromium issue 513922055 for tracking. If immediate patching is impossible, the practical compensating control is to reduce the renderer-compromise exposure this bug chains from - restrict browsing to trusted sites and block untrusted WebGL/GPU content at the network or policy layer; note this degrades legitimate WebGL functionality and only lowers, not eliminates, the chance of reaching the vulnerable ANGLE path. Users of Chromium-derived browsers should apply their vendor's corresponding update when available.