CVE WatchJul 2, 2026

CVE-2026-14086

Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a cra

CVSS

8.8

High

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Published: Jun 30, 2026 · Last modified: Jul 2, 2026 · CWE-602

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-07-012026-07-21

Technical description

Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-137244.3 MED

10.3%

——3Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation. This issue affects Corporate Training Management System: before dd1a9df64.1d CVE-2026-464858.2 HIG

22.5%

——7Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.1d CVE-2026-151304.3 MED

6.8%

——2Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)12d CVE-2026-141099.6 CRI

16.7%

——5Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)19d CVE-2026-140816.5 MED

7.2%

——2Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)20d CVE-2026-140754.3 MED

11.1%

——3Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low)15d