CVE-2026-14000: Google Chrome XML UXSS Vulnerability – Patch Now (v150.0.7871.47)

Technical summary

CVE-2026-14000 stems from improper handling of XML parsing in Chrome's rendering engine. The vulnerability enables Universal Cross-Site Scripting (UXSS), where an attacker circumvents the same-origin policy by injecting malicious scripts or HTML that execute in the security context of an arbitrary origin. The flaw is triggered via a specially crafted HTML page; no complex user interaction is required beyond visiting the page. Classification as CWE-79 (Improper Neutralization of Input During Web Page Generation) reflects the root cause of inadequate input sanitization during XML processing.

Business impact

Organizations relying on Chrome for corporate browsing face exposure to data exfiltration, session hijacking, and unauthorized modifications to web applications users interact with. The UXSS nature means attackers can target users of any website by hosting a malicious page, then injecting content to compromise sessions on banking, SaaS, or internal web applications. This is particularly concerning for organizations where Chrome is the standard browser and users visit untrusted or compromised third-party sites. The scope impact (network-wide privilege escalation potential) elevates business risk despite the medium severity rating.

Affected systems

Google Chrome releases prior to version 150.0.7871.47 are vulnerable. This includes stable, beta, and extended-release channels. Chromium-based browsers that have not backported the fix may also be affected, though the advisory specifically names Google Chrome. Desktop and mobile versions of Chrome with version numbers below the patch threshold require immediate attention.

Exploitability

Exploitability is straightforward. The attack vector is network-based (no local access required), requires no privileges, and demands minimal user interaction—only visiting a crafted webpage. The barrier to exploitation is low; an attacker needs only to host a malicious page and trick or socially engineer a user into visiting it, or compromise a legitimate website to serve the payload. No special tools or insider knowledge are necessary. However, the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active real-world exploitation may not yet be widespread, though this does not diminish the need for rapid patching.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism typically deploys patches within hours to days, but administrators should verify deployment in their environment. For organizations managing Chrome via policy (e.g., via Google Admin Console or third-party MDM), confirm that the update has propagated to all endpoints. Interim mitigations include restricting user browsing to known-safe sites and disabling Chrome extensions that may amplify attack surface, though patching is the definitive remediation.

Patch guidance

Google has addressed this vulnerability in Chrome 150.0.7871.47 and later. Verify the patch version against the official Chrome release notes and security advisories published by Google. Most users will receive the update automatically through Chrome's built-in update system; check via Settings > About Chrome to trigger an immediate check. Enterprise administrators should review Google's official security advisory for version-specific patch guidance, staged rollout recommendations, and any known compatibility concerns. Test the update in a non-critical environment before broad deployment if your organization has change management requirements.

Detection guidance

Monitor network traffic and endpoint logs for visits to suspicious or recently-compromised domains, particularly those not previously accessed by users. Web Application Firewalls (WAFs) should be configured to detect and block payloads containing XML-based injection vectors or suspicious script tags injected via XML contexts. Endpoint Detection and Response (EDR) solutions can flag unusual script execution originating from the Chrome process, especially when correlated with visits to untrusted sites. Check Chrome version compliance across your fleet using MDM solutions or inventory tools to ensure all instances are running 150.0.7871.47 or later. Threat hunting should focus on identifying users who visited known-malicious or compromised pages around the time this vulnerability became public.

Why prioritize this

Although the CVSS score of 6.1 (medium) is not in the critical range, the practical risk is elevated. UXSS vulnerabilities undermine the browser's fundamental security model and can lead to account compromise, credential theft, and unauthorized access to sensitive web applications. The combination of easy exploitability, network-wide attack surface, and high business impact of successful exploitation warrants treating this as high-priority despite the medium severity rating. Organizations should prioritize patching ahead of other medium-severity vulnerabilities that may have lower real-world risk.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a medium-severity vulnerability with network-based attack vector, low attack complexity, no privilege requirements, and user interaction (viewing a page). Confidentiality and integrity are impacted (score L for both) while availability is not. The scope change (S:C) acknowledges that an impacted component can affect resources outside its security scope. The score does not fully capture the severity of UXSS in practice—session hijacking, data theft, and lateral movement within web applications—which is why manual risk assessment by your team is essential. Consider your organization's exposure to untrusted websites and the sensitivity of data accessible via web browsers when adjusting internal risk prioritization.

Frequently asked questions