What is the CVSS score of CVE-2026-14415?

CVE-2026-14415 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14415?

Google Chrome versions before 150.0.7871.46 contain a memory corruption flaw allowing remote code execution when users visit crafted webpages.. A patch is available.

How to fix or mitigate CVE-2026-14415?

Within 24 hours: Issue advisory recommending users update Chrome to version 150.0.7871.46 or later and configure automatic updates if not already enabled. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all managed endpoints via patch management systems or MDM. Within 30 days: Verify deployment completion across the organization and remediate any systems running vulnerable versions.

Google Chrome CVE-2026-14415

EUVD-2026-41162 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-01 Chrome

GHSA-47w9-22r8-93hx

Buffer Overflow Google Heap Overflow Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–High)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable and unauthenticated, but the required specific UI gestures plus heap-grooming raise complexity (AC:H) beyond a simple page visit; renderer-only impact keeps scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:23 vuln.today

CVSS changed

Jul 02, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Heap corruption in the V8 JavaScript engine of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a user to a crafted HTML page and coaxes them into specific UI gestures potentially achieve memory corruption and code execution in the renderer. The flaw was reported internally by the Chrome team and is patched in the Stable channel; no public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile). Note the tension in the signals: NVD/aggregator CVSS is 8.8 (High) while Google's own Chromium severity rating is Low.

Technical ContextAI

V8 is Chrome's high-performance JavaScript and WebAssembly engine, which JIT-compiles and executes untrusted script from any visited web page. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), meaning an operation writes past the bounds of a heap-allocated buffer - in V8 this typically stems from an object-shape, type-confusion, or bounds miscalculation during optimized code execution ('inappropriate implementation'). Because V8 runs attacker-controlled script directly, heap corruption here can be groomed into a controlled write primitive, though it remains confined to the sandboxed renderer process absent a separate sandbox-escape bug. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the desktop Chrome browser across platforms prior to the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel; on managed fleets, force-relaunch to complete the update since Chrome only applies a downloaded update after restart. The vendor advisory with details is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Until the update is applied, compensating controls include enabling/enforcing Chrome's Site Isolation and the sandbox (default, keep enabled) so renderer corruption stays contained, and restricting users from browsing untrusted sites; because exploitation additionally requires the user to perform specific UI gestures, user-awareness guidance to avoid interacting with unexpected page prompts meaningfully lowers risk. These controls do not fix the underlying bug and only reduce exposure, so patching remains the primary action.