What is the CVSS score of EUVD-2026-40788?

EUVD-2026-40788 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google are affected by EUVD-2026-40788?

Google Chrome on macOS prior to version 150.0.7871.47 contains a sandbox escape vulnerability (CVE-2026-14101) that could allow attackers to gain system-wide access after first compromising the…. A patch is available.

How to fix or mitigate EUVD-2026-40788?

Within 24 hours: Identify Chrome deployment prevalence on macOS systems and establish update timeline. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all macOS endpoints through standard patch management. Within 30 days: Confirm patch deployment across the macOS fleet and validate version compliance.

Google EUVD-2026-40788

| CVE-2026-14101 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-wrjp-3p2g-xhpf

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

5.7 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:24 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionNVD

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome on macOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page. The root cause is insufficient policy enforcement in Chrome's macOS sandbox (CWE-693). …