CVE-2026-14001: Chrome UXSS Vulnerability (v<150.0.7871.47) – Patch Guidance

Technical summary

The vulnerability stems from improper implementation in Chrome's Network component that fails to adequately sanitize or isolate untrusted HTML and script content. The flaw allows Cross-Site Scripting (CWE-79) execution that can cross security boundaries between origins. The attack requires user interaction—visiting a malicious or compromised webpage—but does not require the attacker to have special privileges. Once triggered, injected scripts execute in the context of the visited site, gaining access to sensitive data and session tokens.

Business impact

Organizations with employees using Chrome face exposure to data exfiltration, session hijacking, and credential theft. Attackers could inject code to capture login credentials, OAuth tokens, or confidential information visible on internal web applications. The attack surface is broad because it requires only that a user visit a crafted page, which could be distributed via email, advertisements, or compromised legitimate sites. Incident response and forensics may be required if the vulnerability is exploited before patching.

Affected systems

All installations of Google Chrome prior to version 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, and mobile platforms (Chrome for Android, Chrome for iOS). Enterprise deployments that have not yet updated to the fixed version or later remain at risk. Users and organizations should verify their current Chrome version against the vendor advisory to confirm patch status.

Exploitability

Exploitability is practical and does not require advanced techniques. An attacker needs only to serve a crafted HTML page and wait for a user to visit it. No authentication, special network position, or victim interaction beyond clicking a link or visiting a website is required. The CVSS score of 6.1 reflects the network-accessible attack vector and low complexity, though confidentiality and integrity impact are rated low rather than high because the damage is scoped to the visited origin rather than the entire browser.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. For enterprise environments, enable automatic updates or use centralized patch management to roll out fixes across all endpoints. Verify the update has been applied by checking Chrome's version in Settings > About Chrome. Organizations with managed devices should confirm update deployment via their mobile device management or endpoint management solutions.

Patch guidance

Google has released version 150.0.7871.47 and later as the patched version. Check your current Chrome version at chrome://settings/help or Settings > About Chrome; the browser will show installed version and auto-check for updates. For managed enterprise deployments, consult your Chrome deployment documentation to push updates via Group Policy (Windows), managed configuration (macOS), or mobile device management. No manual workarounds are available; patching is the only remedy.

Detection guidance

Monitor for UXSS exploitation by logging and analyzing HTTP requests to your web properties for suspicious or obfuscated script injection attempts. Review browser console errors and security warnings on endpoints if users report unusual behavior (unexpected pop-ups, page redirects, or credential prompts). Examine network traffic for connections to unexpected domains that might indicate exfiltration. Web application firewalls and content security policy violations can help flag malicious injection attempts.

Why prioritize this

This vulnerability warrants prompt attention because it affects a widely deployed browser used across most organizations, requires minimal attacker effort, and can lead to credential and data theft. Although the CVSS score is medium and the vulnerability is not yet tracked as actively exploited (KEV status is false), the low barrier to exploitation and broad user base mean that opportunistic attacks are likely once the vulnerability becomes public knowledge. Prioritize patching for endpoint protection; delay increases compromise risk.

Risk score, explained

CVSS 6.1 (Medium) reflects a network-accessible vulnerability with low attack complexity and user interaction required. The scope is changed (script execution crosses origin boundaries), but impact is limited to confidentiality and integrity (data leakage and code injection) without availability impact. The score appropriately captures that this is a serious but not critical issue; however, real-world risk may be higher in environments where users frequently visit untrusted sites or where attackers can inject malicious content into legitimate web properties.

Frequently asked questions