CVE-2026-14000

MediumCVSS 6.1

Published: 30/06/2026(UTC)Updated: 01/07/2026(UTC)Translated: 02/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile — higher than 7% of all known CVEs

Summary

Inappropriate implementation in XML handling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. The vulnerability has a medium severity rating according to Chromium.

Risk Assessment

An attacker can exploit this vulnerability to perform a Universal XSS attack, potentially leading to data theft, session hijacking, or displaying fake content within trusted websites.

Recommendation

Immediately update Google Chrome to version 150.0.7871.47 or later. It is also recommended to enable automatic updates for all users.

Original NVD description (English source)

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)