What is the CVSS score of CVE-2026-14416?

CVE-2026-14416 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-14416?

Google Chrome versions before 150.0.7871.46 contain a memory vulnerability in the WebGPU implementation that could allow attackers to escape the browser sandbox and access sensitive memory through a…. A patch is available.

How to fix or mitigate CVE-2026-14416?

Within 24 hours: Inventory all Chrome deployments (desktop, mobile, managed endpoints) and identify update mechanisms (auto-update status, MDM controls, manual deployment). Within 7 days: Deploy Chrome 150.0.7871.46 or later to all endpoints; prioritize user-facing systems and those accessing sensitive web applications. Within 30 days: Audit deployment completion through browser telemetry or MDM reporting and verify no successful exploitation attempts in logs.

Google Chrome CVE-2026-14416

EUVD-2026-41181 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-01 Chrome

GHSA-v42f-jwg7-7q69

Buffer Overflow Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs a victim visit (AV:N/UI:R, PR:N); crossing the sandbox boundary gives S:C; an out-of-bounds read is primarily a disclosure primitive (C:H) with only speculative integrity/availability impact (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:23 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds read in the Dawn WebGPU implementation of Google Chrome before 150.0.7871.46 lets a remote attacker who lures a victim to a crafted HTML page potentially escape the renderer sandbox and disclose out-of-bounds memory. The upstream Chromium team rated the security severity as Low, yet the associated CVSS 3.1 base score is 9.6 due to a scope change and high triad impact. There is no public exploit identified at time of analysis, and the CISA SSVC decision framework records exploitation as none and automatable as no.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU API, providing browser access to the GPU for accelerated graphics and compute directly from JavaScript in a web page. The flaw is classified as CWE-125 (Out-of-bounds Read), meaning code reads memory outside the bounds of an intended buffer - here inside the GPU command/validation path that Dawn exposes to untrusted web content. Because WebGPU processing straddles the sandboxed renderer and more privileged GPU/browser process boundaries, an out-of-bounds read in Dawn can leak adjacent memory and, per the advisory, potentially contribute to a sandbox escape. The affected code path is reachable purely from web content, which is why the vector is network with user interaction (visiting a page).

RemediationAI

Update to Google Chrome 150.0.7871.46 or later on the Stable channel, which contains the vendor-released fix (Vendor-released patch: 150.0.7871.46); most installations receive this automatically, so verify via chrome://settings/help and relaunch to apply the update. Reference the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If patching must be delayed, the practical compensating control is to disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled (or via enterprise policy) to remove the vulnerable Dawn attack surface - the trade-off is loss of GPU-accelerated WebGPU features for legitimate sites; browsing untrusted pages should also be restricted until the update is deployed.