CVE-2026-14002: Chrome Geolocation UI Spoofing in Renderer Process

Technical summary

CVE-2026-14002 is a Medium-severity UI spoofing vulnerability in Chrome's geolocation implementation that requires a compromised renderer process. The underlying issue is classified as CWE-451 (User Interface Manipulation), indicating that the geolocation permission UI lacks sufficient safeguards against tampering by code running in the renderer sandbox. An attacker with renderer-level code execution can craft HTML pages that display convincing but unauthorized geolocation prompts, bypassing user intent validation. This is particularly dangerous because users typically trust Chrome's native UI elements and may grant permissions without scrutiny.

Business impact

While the CVSS score of 6.5 reflects that this requires pre-existing renderer compromise, the integrity impact is significant. Attackers who have already broken into a renderer process could abuse geolocation spoofing to track user location, exfiltrate that data, or use it in downstream phishing or social engineering attacks. For organizations with sensitive location data or high-value targets, this vector could be chained with other exploits to establish persistent surveillance. End-user organizations should view this as part of a broader defense-in-depth picture: if renderer processes are being compromised, this vulnerability becomes a secondary concern compared to the initial compromise, but it does increase the damage.

Affected systems

All Google Chrome installations prior to version 150.0.7871.47 are affected. This includes Windows, macOS, Linux, Android, and iOS variants. Enterprise deployments should verify their Chrome version against the fixed version number and prioritize update rollout, especially for users in roles that handle sensitive location data or are targets of nation-state or sophisticated threat actors.

Exploitability

Exploitation requires two preconditions: (1) the attacker must have already compromised the Chrome renderer process, and (2) the user must interact with a malicious HTML page served by or injected by the attacker. This is not a wormable or network-level vulnerability—it is a post-compromise attack enhancement. The barrier to exploitation is moderate for an attacker who already controls code in the renderer sandbox but is high for an attacker starting from network access alone. No public proof-of-concept or active exploitation is currently known.

Remediation

Update Google Chrome to version 150.0.7871.47 or later as soon as possible. Enterprise administrators should enable automatic updates or push Chrome updates through their device management systems. Users can verify their version by navigating to chrome://settings/help, which will also auto-download and prompt for restart if an update is available. Patch urgency is justified by the Medium severity rating and the fact that this is a UI manipulation vector that could enable social engineering downstream of other compromises.

Patch guidance

Google has released Chrome 150.0.7871.47 to fix this vulnerability. Users should apply this update immediately through standard Chrome update mechanisms. Enterprise organizations using Google Chrome Enterprise or a similar managed deployment should prioritize this patch in their change management queue. Verify patch application by checking the version in chrome://version/ and confirming it meets or exceeds 150.0.7871.47. Rollout risk is low since this is a security patch from the vendor without known compatibility issues.

Detection guidance

Network-based detection is limited because exploitation occurs entirely within the user's browser sandbox. Endpoint detection should focus on monitoring for abnormal renderer process behavior, unusual geolocation permission grants, or unauthorized access to location APIs. EDR tools should flag patterns where geolocation permissions are granted in quick succession or to unexpected origins. Log Chrome sync data or geolocation audit trails if available in your organization's Chrome reporting infrastructure. Additionally, monitor for indicators of renderer process compromise (memory corruption, unexpected module loads) which is the necessary precursor to this attack.

Why prioritize this

This vulnerability should be patched promptly but is not critical. It requires pre-existing renderer compromise to exploit, placing it below RCE and sandbox-escape vulnerabilities in the priority queue. However, the UI spoofing vector is particularly concerning for users with valuable location data or those targeted by sophisticated threat actors. The fact that it is not on CISA's KEV list reflects its dependence on prior exploitation. Organizations handling location-sensitive data or operating in high-threat environments should elevate this to a faster patch cycle; general enterprises can bundle it into their regular Chrome update schedule.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is appropriate given the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability is network-accessible but requires low attack complexity and user interaction, plus a pre-compromised renderer. There is no confidentiality impact (geolocation spoofing itself doesn't leak data), but high integrity impact (users can be tricked into granting false permissions). The score correctly reflects that this is a secondary exploitation step, not a primary entry point.

Frequently asked questions