CVE-2026-14056
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
Insufficient validation of untrusted input in the Media component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted video file.
Risk Assessment
The risk for the organization is the potential escalation from a compromised renderer process to full system compromise, leading to data confidentiality and integrity breaches. Although the severity is low in Chromium's scale, it can pose a security threat in corporate environments.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later. Consider restricting playback of video files from untrusted sources.
Original NVD description (English source)
Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Low)