Critical Vulnerability in Google Chrome Allows Remote Code Execution

Endorlabs

Critical Vulnerability in Google Chrome Allows Remote Code Execution

First seen 3 Jul 2026, 13:32 UTC • •57.8

Article Content

1 / 20

Browse articles

ThreatCluster •July 4, 2026 at 11:22 UTC

•CVE-2026-14104 allows remote code execution in vulnerable Google Chrome versions.
•The vulnerability affects Chrome versions prior to 150.0.7871.47 with a CVSS score of 9.8.
•Users are urged to update to the latest Chrome version to protect against this flaw.

A critical vulnerability, CVE-2026-14104, was identified in Google Chrome versions prior to 150.0.7871.47. This flaw involves insufficient validation of untrusted input in WebAppInstalls, enabling remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability has been assigned a CVSS score of 9.8, indicating its severity. Affected users are those running the vulnerable versions of Google Chrome. The vulnerability was confirmed by three independent sources before publication. Currently, the Chromium security severity is rated as low, suggesting that while serious, it may not be actively exploited. Users are advised to update to the latest version to mitigate risks. This incident highlights the ongoing need for vigilance in web application security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 99d ago How this analysis works

Timeline

2026-04-08

CVE-2026-5915 published

Another vulnerability, CVE-2026-5915, was disclosed, affecting WebML in Chrome, allowing out of bounds memory writes.

2026-06-30

CVE-2026-14104 published

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome was disclosed, allowing remote code execution.

2026-07-03

Vulnerability reported by NVD

NVD confirmed the details of CVE-2026-14104, reiterating the risk of remote code execution.

More articles in this cluster (19)

Threat Graph

8 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1203 - Exploitation for Client Execution

Vulnerability (2)

CVE-2026-14104
CVE-2026-5915

Weakness (2)

CWE-20 - Improper Input Validation
CWE-416 - Use After Free

Affected Platform (1)

Chromium

Tool (1)

Google Chrome

Relationships

Google Chrome exploits CVE-2026-14104
Google Chrome exploits CVE-2026-5915
CVE-2026-14104 targets Chromium
CVE-2026-5915 targets Chromium
Zero-day Exploit targets Chromium
T1203 - Exploitation for Client Execution targets Chromium
CVE-2026-14104 related to CWE-20 - Improper Input Validation
CVE-2026-14104 related to CWE-416 - Use After Free

Following this threat?

Track CVE-2026-14104 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…