CVE-2026-14001

MediumCVSS 6.1

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile — higher than 7% of all known CVEs

Summary

Inappropriate implementation in the Network component in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. The vulnerability has a medium severity rating according to Chromium.

Risk Assessment

An attacker can exploit this vulnerability to perform a Universal XSS attack, potentially leading to theft of credentials, user sessions, or modification of content displayed in the browser.

Recommendation

Immediately update Google Chrome to version 150.0.7871.47 or later. It is also recommended to enable automatic updates for all Chrome instances in the organization.

Original NVD description (English source)

Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)