CVE-2026-14012

Google Chrome ≤ 150.0.7871.47

Published

30 June 2026

Modified

01 July 2026

Patch / advisory

View advisory

CVSS Score v3.1 5.3

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score 0.0021 11th percentile

Risk Priority 40 floored blend · peak EPSS

Summary

CVE-2026-14012 is a medium-severity Improper Protection of Physical Side Channels (CWE-1300) vulnerability in Google Chrome. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to PE-19 (Information Leakage) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-40700

Vulnerability Data

Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CWE(s): CWE-1300

Related Threats

CVEs Like This One

CVE-2026-8017Same product: Apple Macos

CVE-2025-13992Same product: Apple Macos

CVE-2025-11210Same product: Apple Macos

CVE-2026-8562Same product: Apple Macos

CVE-2026-3929Same product: Apple Macos

CVE-2026-11153Same product: Apple Macos

CVE-2026-5876Same product: Apple Macos

CVE-2026-11289Same product: Apple Macos

CVE-2025-11207Same product: Apple Macos

CVE-2026-11284Same product: Apple Macos

Affected Assets

google

chrome

≤ 150.0.7871.47

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

2 hardening rules · 1 OS baseline

Validate

Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

PE-19 Information Leakage partial match

Directly requires protection against electromagnetic emanation leakage, which stops one class of the physical side-channel exposures described in CWE-1300.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-06 partial match

prevents

Limiting physical access reduces opportunity for side-channel observation but does not address emission-protection mechanisms inside the device.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.1 Physical security perimeters partial match

mitigates

Physical perimeters can limit attacker proximity needed for side-channel capture.

A.7.2 Physical entry partial match

mitigates

Entry controls reduce opportunities for physical observation of emissions.

A.7.3 Securing offices, rooms and facilities partial match

mitigates

Securing rooms and facilities can shield equipment from side-channel probing.

A.7.4 Physical security monitoring partial match

mitigates

Monitoring deters or detects attempts to exploit physical side channels.