What is the CVSS score of CVE-2026-14432?

CVE-2026-14432 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14432?

Google Chrome users face arbitrary code execution through a use-after-free vulnerability in the V8 JavaScript engine (CVE-2026-14432) triggered by visiting malicious websites; no public exploit has…. A patch is available.

How to fix or mitigate CVE-2026-14432?

Within 24 hours: Inventory all Chrome installations across the organization and prepare patch distribution via your MDM/endpoint management solution. Within 7 days: Deploy Chrome 150.0.7871.46 or later to all critical business functions and user populations. Within 30 days: Achieve 100% patch adoption across all Chrome instances including personal and unmanaged devices accessing corporate networks.

Google Chrome CVE-2026-14432

EUVD-2026-41204 HIGH

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-x56g-fv8q-3mv6

Memory Corruption Google Denial Of Service Use After Free RCE Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted page needs no auth (PR:N) but a user visit (UI:R); renderer code execution stays in-sandbox (S:U) with high C/I/A within that process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 02:24 vuln.today

CVSS changed

Jul 02, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jul 01, 2026 - 22:22 cve.org

HIGH 8.8

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in Chrome's V8 JavaScript engine (versions before 150.0.7871.46) lets a remote attacker achieve arbitrary code execution inside the renderer sandbox by luring a victim to a crafted HTML page. Chromium rated this Medium severity, but the CVSS 8.8 reflects high confidentiality, integrity, and availability impact requiring only a single user click; there is no public exploit identified at time of analysis and CISA's SSVC framework records no known exploitation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page

Delivery

Victim visits page in Chrome

Exploit

JavaScript triggers V8 use-after-free

Execution

Reclaim freed heap object

Impact

Execute arbitrary code in renderer sandbox

Access

Host crafted HTML page

Delivery

Victim visits page in Chrome

Exploit

JavaScript triggers V8 use-after-free

Execution

Reclaim freed heap object

Impact

Execute arbitrary code in renderer sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load attacker-controlled HTML/JavaScript in an unpatched Chrome before 150.0.7871.46 (UI:R - a page visit satisfies this; no prior authentication is needed since PR:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and should be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or injects a malicious ad/iframe into a trafficked site) containing JavaScript that triggers the V8 use-after-free. A victim running an unpatched Chrome simply visits the page (UI:R - the required interaction), the engine dereferences freed memory, and the attacker gains code execution within the renderer sandbox. …
Remediation	Vendor-released patch: 150.0.7871.46 - update Chrome to 150.0.7871.46 or later via the Stable channel and restart the browser to load the new V8 build, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Chrome installations across the organization and prepare patch distribution via your MDM/endpoint management solution. …

Threat intelligence, references, and detailed analysis are available after sign-in.