What is the CVSS score of CVE-2026-14419?

CVE-2026-14419 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14419?

Google Chrome desktop browsers contain a critical sandbox escape vulnerability (CVE-2026-14419, CVSS 9.6) in the Skia graphics library affecting all versions prior to 150.0.7871.46.. A patch is available.

How to fix or mitigate CVE-2026-14419?

Within 24 hours: Inventory all Chrome desktop deployments and confirm current versions across the organization. Within 7 days: Deploy Chrome 150.0.7871.46 (June 2026 Stable channel) to all desktop systems; prioritize high-value user groups and systems with sensitive data access. Within 30 days: Complete rollout to all Chrome installations and verify deployment success across all endpoints.

Google Chrome CVE-2026-14419

EUVD-2026-41201 CRITICAL

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-4m7r-jcc4-f5fx

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs the user to open it (UI:R) but no auth (PR:N); sandbox escape crosses a trust boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:23 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library affects all desktop Chrome builds prior to 150.0.7871.46, where a use-after-free (CWE-416) triggered by a crafted HTML page can let a remote attacker break out of the renderer sandbox. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as none. A vendor patch is available in the June 2026 Stable channel release.

Technical ContextAI

The flaw resides in Skia, Chromium's 2D graphics rendering engine used to rasterize web content, canvas, and compositing operations. As a CWE-416 use-after-free, the root cause is that Skia continues to reference a heap object after it has been freed, allowing a specially crafted HTML page to reclaim and control that memory. Because Skia runs across renderer and GPU processes, corrupting its object lifetime is a well-known primitive for escalating from renderer-level code execution toward a sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all versions below the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the June 2026 Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html), then fully restart the browser so all renderer and GPU processes reload the patched Skia code. In managed fleets, force the update through enterprise update policies rather than relying on user-initiated relaunch. As an interim compensating control before patching, restrict browsing to trusted sites and keep Chrome's site isolation and sandbox enabled; note these reduce but do not eliminate exposure since the trigger is a crafted HTML page, so patching remains the only reliable fix.