CVE-2026-13914: Chrome macOS Password Memory Disclosure Vulnerability

Technical summary

CVE-2026-13914 stems from an inappropriate implementation in Chrome's password management subsystem on macOS. The vulnerability enables unauthorized information disclosure from process memory through a malicious file artifact. The attack vector is local, requires user interaction with the malicious file, and does not escalate privileges or modify system state. The underlying weakness is categorized under CWE-284 (Improper Access Control), indicating that the password subsystem fails to properly restrict access to sensitive memory regions containing credential or authentication data.

Business impact

For organizations with macOS-based workforces, this vulnerability creates a localized but material risk to credential security. If an attacker gains local system access—through physical proximity, a compromised network share, or supply chain compromise—and a user opens a malicious file, Chrome's stored or in-memory password data could be extracted. This is particularly concerning for environments relying on Chrome as a primary browser for SaaS authentication and password manager integration. The risk is elevated in shared-device or contractor-access scenarios.

Affected systems

Google Chrome on Apple macOS prior to version 150.0.7871.47 is vulnerable. Desktop and laptop macOS systems running Chrome are in scope. The vulnerability does not affect Chrome on Windows, Linux, or mobile platforms, nor does it impact other browsers on macOS. Systems running Chrome 150.0.7871.47 or later are not affected.

Exploitability

Exploitation requires local system access, meaning the attacker must either have a user account on the affected Mac or be able to place a file where the user will interact with it (USB drive, shared folder, email attachment). User interaction is mandatory—the user must open or process the malicious file within Chrome. No remote exploitation is possible. The attack does not require Chrome to be the default browser or configured in any special way. While the bar to exploit is not trivial, the combination of local access and social engineering (tricking a user to open a file) is within reach for motivated adversaries targeting specific individuals or small teams.

Remediation

Update Chrome to version 150.0.7871.47 or later on all macOS systems. Google's auto-update mechanism typically deploys new versions within hours of release, but administrators should verify completion. For organizations with managed Chrome deployments, use your deployment management tools (JAMF, Microsoft Intune, Workspace ONE, or similar) to confirm the update has been applied. No workarounds are available; patching is the only mitigation.

Patch guidance

1. Verify the current Chrome version on all macOS devices (Chrome menu > About Google Chrome). 2. If the version is earlier than 150.0.7871.47, initiate the update immediately. Chrome will typically restart after patching. 2. Confirm the update by checking the version number again after restart. 3. For fleet management, deploy via your MDM solution to ensure compliance. If Chrome is pinned to an earlier version for compatibility reasons, reassess that requirement against the security risk and plan an upgrade timeline.

Detection guidance

Monitor for suspicious file interactions on macOS systems running Chrome—particularly files from untrusted sources (downloads, email, USB). Use system audit logging (FSEvents, Endpoint Detection and Response tools) to identify unusual file access or process memory reads. Check Chrome's crash logs and system logs for evidence of crashes or memory corruption following file interaction. Endpoint Detection and Response (EDR) tools may flag attempts to read Chrome process memory directly. In environments with advanced visibility, monitor for .lnk, .dmg, or other file types being processed by Chrome in unusual ways.

Why prioritize this

This vulnerability merits near-term patching because it directly targets credential security—the gateway to organizational systems. While exploitation requires local access and user interaction, those barriers are achievable in targeted attack scenarios. The CVSS 5.5 (Medium) score reflects the need for user interaction but acknowledges the high sensitivity of the targeted data. The lack of KEV (Known Exploited Vulnerability) listing indicates current public exploit code is not widespread, but that does not guarantee an absence of private exploitation. Patching is straightforward and carries minimal risk, making it a high-return remediation activity.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) is driven by a local attack vector with no privilege escalation requirement, user interaction as a prerequisite, and high confidentiality impact (password/credential data) balanced against no integrity or availability impact. The score appropriately reflects that this is not a critical, worm-able vulnerability, but it carries genuine risk in targeted settings where an attacker has already achieved some level of local presence or trust.

Frequently asked questions