What is the CVSS score of CVE-2026-14428?

CVE-2026-14428 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14428?

Google Chrome on Android (versions prior to 150.0.7871.46) contains a sandbox escape vulnerability (CVE-2026-14428, CVSS 8.3) with no identified public exploit at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-14428?

Within 24 hours: identify all devices running Chrome on Android in your organization and document current versions. Within 7 days: deploy Chrome version 150.0.7871.46 or later via mobile device management (MDM) policies; prioritize user populations with access to sensitive systems. Within 30 days: verify deployment completion across all endpoints and validate no devices remain on vulnerable versions prior to 150.0.7871.46.

Google Chrome CVE-2026-14428

EUVD-2026-41168 HIGH

Improper Input Validation (CWE-20)

2026-07-01 Chrome

GHSA-vxwx-6665-hvwh

Information Disclosure Google Red Hat Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered via a web page (AV:N/UI:R) but gated behind a prior renderer compromise making it a chained exploit (AC:H); sandbox escape crosses a trust boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:20 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

8.3 (HIGH)

CVE Published

Jul 01, 2026 - 22:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:21 cve.org

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android (versions prior to 150.0.7871.46) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that abuses insufficient input validation in the Dawn WebGPU component. Google rates the Chromium severity as High, and the flaw carries a CVSS 8.3 with a scope-changing impact. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.

Technical ContextAI

Dawn is Chromium's implementation of the WebGPU API - the layer that translates web-facing GPU commands into calls against native graphics backends (Vulkan/OpenGL ES on Android). Because Dawn processes GPU work partly on behalf of untrusted web content and bridges the sandboxed renderer to more privileged GPU/browser process boundaries, a validation gap here is a classic sandbox-escape surface. The root cause is classified as CWE-20 (Improper Input Validation): untrusted input reaching Dawn is not adequately validated, so a malicious renderer can supply crafted data that violates assumptions in the more privileged process. The only CPE published is the generic cpe:2.3:a:google:chrome:*, which does not by itself encode the Android-specific and version-specific scope stated in the description.

RemediationAI

Vendor-released patch: 150.0.7871.46 - update Google Chrome on Android to 150.0.7871.46 or later, which Chrome typically delivers automatically via the Play Store, so verify the installed version under chrome://version and force an update if devices are pinned to an older build. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the tracking issue https://issues.chromium.org/issues/520180257. As an interim compensating control before patching, disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled (or blocking WebGPU via enterprise policy), which removes the vulnerable Dawn attack surface at the cost of breaking sites that rely on GPU-accelerated WebGPU workloads; enterprise fleets can also enforce automatic Chrome updates via managed Play/Chrome policy to close the window.