What is the CVSS score of CVE-2026-18014?

CVE-2026-18014 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18014?

Yes, a patch is available for CVE-2026-18014. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18014

EUVD-2026-50940 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-6432-w9m2-cv4x

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Malicious file delivered remotely (AV:N), victim must open it (UI:R), no attacker privileges needed (PR:N), only integrity impacted via navigation bypass (I:H, C:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:36 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome DevTools prior to version 151.0.7922.72 enables remote attackers to circumvent browser navigation controls by luring a user into opening a specially crafted malicious file. The flaw stems from CWE-20 insufficient input validation within the DevTools component, resulting in high integrity impact per CVSS. No public exploit has been identified and EPSS exploitation probability is very low at 0.16% (6th percentile); notably, the Chromium security team internally rated this 'Low' severity despite the medium NVD CVSS score of 6.5.

Technical ContextAI

Google Chrome's DevTools is the built-in browser developer toolset providing debugging, inspection, and profiling capabilities. The root cause is CWE-20 (Improper Input Validation): the DevTools component fails to sufficiently validate externally-supplied data from an untrusted file before acting on it, allowing that input to influence Chrome's navigation logic and bypass established navigation restrictions. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions prior to the fix. Chrome's multi-process sandbox architecture typically constrains such issues, but navigation-layer bypasses can undermine browsing context and same-origin enforcement, which is why integrity impact is rated High even if code execution is not implied.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update Google Chrome to version 151.0.7922.72 or later as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically for most users; enterprise administrators should verify deployment via chrome://settings/help or through fleet management tooling. As a compensating control where immediate patching is delayed, administrators can configure the Chrome enterprise policy DevToolsAvailability to restrict or disable DevTools access, which may reduce the exposed attack surface at the cost of developer functionality for affected users. Additionally, user-level mitigation is possible by avoiding opening untrusted files in Chrome, given that the attack chain requires user interaction with a malicious file (UI:R).