What is the CVSS score of CVE-2026-14432?

CVE-2026-14432 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14432?

Google Chrome users face arbitrary code execution through a use-after-free vulnerability in the V8 JavaScript engine (CVE-2026-14432) triggered by visiting malicious websites; no public exploit has…. A patch is available.

How to fix or mitigate CVE-2026-14432?

Within 24 hours: Inventory all Chrome installations across the organization and prepare patch distribution via your MDM/endpoint management solution. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all critical business functions and user populations. Within 30 days: Achieve 100% patch adoption across all Chrome instances including personal and unmanaged devices accessing corporate networks.

Google Chrome CVE-2026-14432

EUVD-2026-41204 HIGH

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-x56g-fv8q-3mv6

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted page needs no auth (PR:N) but a user visit (UI:R); renderer code execution stays in-sandbox (S:U) with high C/I/A within that process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 02:24 vuln.today

CVSS changed

Jul 02, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in Chrome's V8 JavaScript engine (versions before 150.0.7871.46) lets a remote attacker achieve arbitrary code execution inside the renderer sandbox by luring a victim to a crafted HTML page. Chromium rated this Medium severity, but the CVSS 8.8 reflects high confidentiality, integrity, and availability impact requiring only a single user click; there is no public exploit identified at time of analysis and CISA's SSVC framework records no known exploitation. Because scope is unchanged (S:U), code execution is confined to the sandbox and does not by itself constitute a full host compromise.

Technical ContextAI

The flaw is in V8, the C++ engine that compiles and executes JavaScript and WebAssembly in Chrome and all Chromium-derived browsers. CWE-416 (Use After Free) means the engine continues to reference a heap object after it has been freed - typically through optimizer/garbage-collector lifetime bugs - allowing an attacker who controls subsequent heap allocations to reshape the freed memory and hijack execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome application. Because V8 runs within Chrome's multi-process sandbox, this primitive yields code execution in the renderer process; a separate sandbox-escape bug would be needed to reach the host, consistent with the description's phrasing 'inside a sandbox' and the S:U (scope unchanged) metric.

RemediationAI

Vendor-released patch: 150.0.7871.46 - update Chrome to 150.0.7871.46 or later via the Stable channel and restart the browser to load the new V8 build, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). In managed environments, push the update through your browser management policy (e.g., enterprise auto-update) and confirm rollout, since the fix only applies after a restart. Where immediate patching is not possible, the practical compensating control is to reduce exposure to attacker-controlled pages - enforce Chrome's Site Isolation and sandbox (do not launch with --no-sandbox), and restrict browsing of untrusted sites; there is no feature toggle that disables V8 itself, so disabling JavaScript for untrusted sites via policy is the only content-level mitigation and it will break most modern web applications. Users of Chromium-based browsers should apply their vendor's build incorporating the equivalent V8 fix.