What is the CVSS score of CVE-2026-14426?

CVE-2026-14426 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14426?

Google Chrome versions prior to 150.0.7871.46 contain a remote code execution vulnerability that could allow attackers to compromise employee browsers and steal credentials or data through malicious…. A patch is available.

How to fix or mitigate CVE-2026-14426?

Within 24 hours, issue a security alert to all users directing immediate updates to Chrome version 150.0.7871.46 or later and verify that Chrome auto-update is enabled organization-wide. Within 7 days, conduct an inventory scan of all endpoints to identify Chrome instances running versions prior to 150.0.7871.46 and deploy forced updates through your device management platform. Within 30 days, establish metrics confirming that at least 95% of Chrome installations have been updated to version 150.0.7871.46 or later, and document the completed remediation.

Google Chrome CVE-2026-14426

EUVD-2026-41206 HIGH

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-5qxj-7c6x-x6pf

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page with no auth (AV:N/PR:N) but requires user UI gestures and heap grooming (UI:R/AC:H); renderer-sandbox code exec keeps scope unchanged with full CIA impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:39 vuln.today

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in the V8 JavaScript engine of Google Chrome prior to 150.0.7871.46 lets a remote attacker run code inside the renderer sandbox after luring a victim to a crafted HTML page and getting them to perform specific UI gestures. Rated High by Chromium, it carries CVSS 7.5 (AC:H/UI:R) reflecting the required user interaction and attack complexity. There is no public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), consistent with SSVC exploitation status of 'none'.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in V8, the C++ JavaScript/WebAssembly engine that Chrome uses to execute web-page script. Use-after-free bugs arise when the engine continues to reference heap memory that has already been freed, allowing an attacker who controls heap layout to place attacker-controlled data where a stale pointer is dereferenced, corrupting object state and steering execution. Because JavaScript execution is driven directly by untrusted web content, a malicious page can script the precise allocation/free sequences needed to reach the vulnerable state. The affected component (cpe:2.3:a:google:chrome) is the desktop Chrome browser; the same V8 codebase is shared by Chromium-derived browsers and by downstream distributions (the SUSE tag reflects such repackaging).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); confirm by relaunching Chrome so the update applies, since the fix is inert until the browser restarts. In managed fleets, push the updated build through your enterprise update policy and verify version compliance. Because exploitation requires loading a malicious page and specific user interaction, interim compensating controls are effective: restrict browsing via URL/web filtering to block untrusted sites, and consider enabling Chrome's Site Isolation and 'Enhanced Safe Browsing' to raise the exploitation bar - trade-off is minor performance/UX overhead and occasional false-positive site warnings. Users of Chromium-based browsers should apply their vendor's corresponding update once available.