CVE-2026-14006: Chrome Use-After-Free RCE Vulnerability (v150.0.7871.47)

Technical summary

CVE-2026-14006 is a use-after-free condition (CWE-416) in Chrome's navigation subsystem that permits remote code execution. The vulnerability occurs when Chrome fails to properly manage memory references during certain navigation operations, allowing an attacker to reference freed memory and redirect execution flow. The attack vector is network-based with low complexity—no authentication or special privileges are required—but does require user interaction to visit a malicious HTML page. The Chromium security team classified this as Medium severity internally, though the CVSS 3.1 score of 8.8 reflects the high impact potential across confidentiality, integrity, and availability.

Business impact

Successful exploitation could allow attackers to compromise user systems entirely, including stealing sensitive data, installing malware, or using compromised machines as pivot points for lateral network movement. For organizations where employees browse the web on managed Chrome instances, this represents a direct channel for endpoint compromise. The requirement for user interaction slightly lowers the attack surface compared to zero-click flaws, but the ease of distribution via compromised websites or watering-hole attacks makes this a tangible threat to any organization's security posture.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all Chrome deployments across Windows, macOS, Linux, and Android platforms where older versions remain in use. Organizations with slow or staggered update cycles face the highest exposure. Chrome Sync users, enterprise deployments with managed Chrome, and any user running Chrome version 150.0.7871.46 or earlier should be considered at risk.

Exploitability

The vulnerability requires a user to visit a malicious webpage, which is the primary exploitation barrier. No zero-day public exploit code is documented as of the CVE publication date, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. However, the network-based delivery mechanism and low technical complexity mean that once an exploit is publicly available, widespread abuse would be likely. Attackers could distribute the malicious page through compromised websites, phishing campaigns, or ad networks.

Remediation

Users and administrators should update Chrome to version 150.0.7871.47 or later immediately. For enterprise Chrome deployments, push this update through your standard patch management processes, prioritizing systems where users frequently visit untrusted websites. Organizations unable to update immediately should consider restricting user browsing or enforcing additional security controls such as sandboxing, application allowlisting, or network segmentation.

Patch guidance

Update Chrome to version 150.0.7871.47 or later. Most users can trigger updates via the three-dot menu > About Google Chrome, which will automatically download and prompt for restart. Enterprise administrators should consult Google's Chrome Enterprise Release Notes for deployment guidance specific to their environment. Verify successful patching by navigating to chrome://version and confirming the version number meets the minimum threshold. For organizations using Google Workspace, consider enforcing automatic Chrome updates via admin console policies.

Detection guidance

Monitor for signs of exploitation by tracking Chrome crash reports and unusual process behavior associated with the chrome.exe or chromium process (unexpected child processes, network connections, or file modifications). Network-based detection is challenging because the attack vector is a crafted HTML page, not a network signature. Endpoint detection and response (EDR) tools should alert on suspicious activity following Chrome process execution, particularly code injection or unusual system calls. Log Chrome synchronization and profile changes, as attackers may attempt to exfiltrate data. Behavioral analysis of systems running vulnerable Chrome versions, especially those that have visited untrusted sites, provides an additional detection layer.

Why prioritize this

Despite not appearing in CISA's KEV catalog, this vulnerability warrants high priority remediation due to its high CVSS score (8.8), network-based attack vector, and the potential for widespread exploitation once public tools emerge. Chrome's ubiquity in enterprise and consumer environments amplifies impact. The low barrier to triggering user interaction (visiting a webpage) and the availability of a clear patched version make this straightforward to address—organizations should prioritize this update alongside other critical patches.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of a network-based attack requiring minimal complexity and user interaction, coupled with severe impact across all three security domains: attackers can read sensitive data (confidentiality), modify system state (integrity), and disrupt services (availability). While Chromium's internal severity rating is Medium, the CVSS metric appropriately scales the risk higher because it accounts for the full attack surface and real-world exploitability potential. The lack of privilege escalation requirements further elevates the practical threat.

Frequently asked questions