What is the CVSS score of CVE-2026-16414?

CVE-2026-16414 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-16414?

Yes, a patch is available for CVE-2026-16414. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-16414

EUVD-2026-47569 HIGH

Improper Input Validation (CWE-20)

2026-07-21 chrome-cve-admin@google.com

GHSA-jx9v-4gxq-g867

Information Disclosure Google Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack with low complexity and low privileges; sandbox escape leads to full confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:01 vuln.today

CVSS changed

Jul 24, 2026 - 16:07 NVD

7.8 (HIGH)

CVE Published

Jul 21, 2026 - 23:16 nvd

HIGH 7.8

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component allows a local attacker with low privileges to potentially execute arbitrary code outside the sandbox by sending malicious network traffic. Affects Chrome versions prior to 150.0.7871.182. EPSS 0.1% and no KEV listing suggest low real-world exploitation risk despite the high-severity CVSS 7.8 score.

Technical ContextAI

The vulnerability exists in Chromecast, a component that handles screen mirroring and casting via network protocols within the Chrome browser. It arises from insufficient validation of untrusted input (CWE-20) when processing network traffic. An attacker who can inject crafted data can exploit the lack of proper sanitization to break out of the browser's sandbox. The affected product is identified by CPE as Google Chrome, and the flaw is specific to the Chromecast functionality.

RemediationAI

Upgrade Google Chrome to version 150.0.7871.182 or later. The update is available via the browser's built-in update mechanism or from the official blog advisory. As a temporary mitigation, users may disable or restrict Chromecast functionality in Chrome settings, though this will prevent the use of casting features. No other workarounds are documented.