CVE-2026-14101
Chromium: CVE-2026-14101 Insufficient policy enforcement in Sandbox
CVE-2026-14101 is fixed in 3 products on 2 platforms, first by Google Chrome 150.0.7871.47, released June 24, 2026. It is not reported as exploited. Patch Radar priority: Urgent.
UrgentFixed on 2 platforms
CVSS
9.6
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0033
26th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2025">Google Chrome Releases</a> for more information.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| macOS | |||
| Google Chrome | 150.0.7871.47 | Google Chrome 150.0.7871.47 | Jun 24, 2026 |
| Microsoft Edge | 150.0.4078.50 | Microsoft Edge 150.0.4078.50 | Jul 2, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 150.0.7871.46-1~deb12u1 | DEBIAN-CVE-2026-14101 | Jul 5, 2026 |
| chromium · Debian 13.5 (trixie) | 150.0.7871.46-1~deb13u1 | DEBIAN-CVE-2026-14101 | Jul 5, 2026 |
| chromium · Debian 14 | 150.0.7871.46-1 | DEBIAN-CVE-2026-14101 | Jul 5, 2026 |
| chromium · opensuse-leap 16.0 | 150.0.7871.186-bp160.1.1 | OPENSUSE-SU-2026:21498-1 | Aug 31, 2026 |