Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-14120: Google Chrome: Malicious Code Escape from DevTools

CVE-2026-14120 · published 4 months ago

Summary

An attacker who has already compromised a user's computer can use a specific type of web page to break out of a protective barrier and gain more control. This only affects users who are using an outdated version of Google Chrome. To fix this issue, update to the latest version of Google Chrome.

What to do

Update google chrome to version 150.0.7871.47 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	chromium	All versions
Debian:12	debian	chromium	All versions
Debian:13	debian	chromium	All versions
Debian:14	debian	chromium	All versions
–	google	chrome	< 150.0.7871.47 `cpe:2.3:a:google:chrome::::::::`

Original advisory text

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a cra...

References

https://security-tracker.debian.org/tracker/CVE-2026-14120 Vendor Advisory
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
https://issues.chromium.org/issues/513777411 Permissions Required

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-693Protection Mechanism Failure

CWE-20Improper Input Validation

Timeline

Published30 Jun 2026

Updated3 Nov 2026

First seen1 Jul 2026

Sources

DEBIAN-CVE-2026-14120 · OSV

CVE-2026-14120 · NVD

Track software like this

Free during beta