CVE-2026-14393

HighCVSS 8.8

Published: 01/07/2026(UTC)Updated: 03/07/2026(UTC)Translated: 04/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile — higher than 20% of all known CVEs

Summary

A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox.

Risk Assessment

The risk involves remote code execution, potentially allowing an attacker to compromise the browser and possibly the underlying system, despite sandbox restrictions.

Recommendation

Immediately update Google Chrome to version 150.0.7871.46 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)