CVE-2026-14407 is a high-severity vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw exists in versions before 150.0.7871.46 and allows a remote attacker to execute arbitrary code inside the browser's sandbox environment via a specially crafted HTML page. The vulnerability is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 8.8, indicating a critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication.

Successful exploitation could allow an attacker to execute arbitrary code within the sandboxed environment of the browser, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable unauthorized actions or data access within the browser context.

A fixed version of Google Chrome is available at 150.0.7871.46. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked confirms the availability of this update. No additional mitigation steps are indicated.