What is the CVSS score of CVE-2026-14425?

CVE-2026-14425 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14425?

Google Chrome versions prior to 150.0.7871.46 contain a critical sandbox escape vulnerability that allows remote attackers to potentially compromise endpoint security through malicious web pages,…. A patch is available.

How to fix or mitigate CVE-2026-14425?

Within 24 hours: Identify all Chrome desktop installations in your environment; communicate mandatory update requirement to users and IT teams. Within 7 days: Deploy Chrome 150.0.7871.46 or later to 100% of affected systems through your update mechanism (auto-update, MDM, or managed deployment). Within 30 days: Audit deployment completion; review security logs and crash reports for exploitation indicators.

Google Chrome CVE-2026-14425

EUVD-2026-41198 CRITICAL

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-vrq7-mpjq-fcxr

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs user interaction (UI:R) but no privileges; a sandbox escape crosses a trust boundary (S:C) with total renderer memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:21 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 150.0.7871.46, where a use-after-free condition lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity High and a fixed stable-channel build is available, but SSVC records no observed exploitation and no public exploit identified at time of analysis. The high CVSS (9.6) is driven by the scope change inherent to sandbox escape rather than confirmed real-world abuse.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls into the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced WebGL/graphics content and straddles the boundary between the sandboxed renderer and lower-level GPU handling, memory-safety bugs here are especially valuable for sandbox escapes. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains, and subsequent access to that reference can corrupt memory and be leveraged for controlled code execution. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and while Chrome itself is the named product, the same ANGLE code is shared by other Chromium-based browsers.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the stable desktop channel, then relaunch the browser to apply the update, as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of other Chromium-based browsers should apply their vendor's build that incorporates the equivalent ANGLE fix. Where immediate patching is not possible, exposure can be reduced by restricting browsing to trusted sites and by disabling hardware-accelerated graphics / WebGL (chrome://settings 'Use graphics acceleration when available', or enterprise policy 'HardwareAccelerationModeEnabled=false'), which lowers the attack surface in ANGLE at the cost of degraded graphics performance and broken WebGL-dependent web applications; this is a mitigation, not a substitute for the update.