cvss mismatch

The cvss mismatch tag tracks discussions about security vulnerabilities whose formal severity ratings differ from external risk assessments. The current content focuses on CVE-2026-14087, a WebNN heap buffer overflow fixed in Chrome 150 for Windows. Chromium rated the issue Low because exploitation requires an attacker to have already compromised the renderer process, while CISA’s enrichment assigns a High CVSS 3.1 score. This archive examines why those ratings can diverge, how exploit prerequisites affect practical risk, and why AI-adjacent browser components such as WebNN are becoming relevant to security and update decisions. It is useful for readers comparing vendor severity labels with broader vulnerability scoring and threat context.