What is the CVSS score of CVE-2026-14427?

CVE-2026-14427 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14427?

Google Chrome contains a critical security vulnerability (CVE-2026-14427, CVSS 8.3) that could allow attackers to completely compromise systems and access corporate data when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-14427?

Within 24 hours: Identify and audit all Chrome instances across the organization and assess user segments with elevated privileges. Within 7 days: Deploy Chrome version 150.0.7871.46 or later across all endpoints using standard patch management; prioritize users with administrative access or network connectivity to sensitive systems. Within 30 days: Verify 100% remediation of all unpatched instances and review logs for any exploitation attempts.

Google Chrome CVE-2026-14427

EUVD-2026-41156 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-01 Chrome

GHSA-5j96-jmxf-j97q

Buffer Overflow Google Heap Overflow Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires prior renderer compromise (PR:L) and reliable heap grooming (AC:H) plus loading a crafted page (UI:R); sandbox escape crosses a trust boundary (S:C) with total host impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:20 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

8.3 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome desktop before 150.0.7871.46 is possible through a heap buffer overflow in the Skia graphics library, letting an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a second-stage bug: it presumes prior renderer code execution rather than granting initial access on its own. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.

Technical ContextAI

Skia is the open-source 2D graphics rendering engine that Chrome (and Chromium-based browsers) uses to rasterize web content, canvas, and compositor layers. The flaw is CWE-122 (heap-based buffer overflow), meaning attacker-influenced rendering input causes a write past the bounds of a heap-allocated buffer inside Skia. Because Skia runtime state is reachable from GPU/compositor code paths that straddle the renderer sandbox boundary, corrupting its heap can be leveraged to influence a more-privileged process and escape the sandbox. The affected component per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.46 or later on all desktop platforms, then fully restart the browser so the new build loads (per the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Most environments receive this automatically, but verify via chrome://settings/help and push the update through enterprise management (Google Update / MDM policy) where auto-update is disabled. If patching must be delayed, reduce the attack surface by restricting exposure to untrusted web content - enforce strict site isolation (default in Chrome), deploy browser policies to limit or disable GPU/hardware acceleration of untrusted content, and use URL allow-listing for high-risk users; note these controls degrade rendering performance and do not fully close the bug. Chromium-based browsers should be updated once they ship a build incorporating the fixed Skia.