CVE-2026-14409
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile — higher than 18% of all known CVEs
Summary
An inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as low severity.
Risk Assessment
The risk for the organization is the potential for remote code execution within the sandbox, which could lead to data or system compromise, but it requires user interaction and is considered low severity.
Recommendation
It is recommended to immediately update Google Chrome to version 150.0.7871.46 or later to mitigate the vulnerability.
Original NVD description (English source)
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)