CVE-2026-14009: Google Chrome Heap Corruption via Password Handling

Technical summary

CVE-2026-14009 is an inappropriate input validation issue (CWE-20) in the Passwords implementation of Google Chrome's rendering engine. The vulnerability allows heap memory corruption when processing a specially crafted HTML page. The attack vector is network-based with low complexity, requires user interaction (visiting a malicious page), and operates in the user context. The Chromium security team initially classified this as Medium severity at discovery, though the CVSS 3.1 assessment reflects the potential for confidentiality, integrity, and availability impact due to heap corruption primitives.

Business impact

Exploitation of this vulnerability could allow attackers to compromise user data, including stored credentials and sensitive information within the browser process. In targeted campaigns, adversaries could use crafted pages distributed via email, advertisements, or compromised websites to gain code execution on end-user machines. Organizations with large Chrome deployments should prioritize patching to prevent potential credential theft and lateral movement.

Affected systems

Google Chrome browsers on all platforms (Windows, macOS, Linux) running version 149.0.7871.46 and earlier are affected. This includes enterprise deployments using Chrome as a managed browser. The vulnerability does not affect other Chromium-based browsers unless they have independently failed to integrate the fix.

Exploitability

Exploitation requires a user to navigate to or interact with a malicious webpage. The attack has network accessibility and no privilege requirements, making it relatively easy to deliver via watering hole attacks, malicious ads, or phishing campaigns. However, it is not a zero-click vulnerability and does not spread automatically. Real-world exploitation is feasible but depends on social engineering or drive-by download tactics.

Remediation

Upgrade Google Chrome to version 150.0.7871.47 or later. For enterprise environments, use Chrome's managed deployment policies to enforce automatic updates or schedule a forced update window. Verify the update has been applied by checking Chrome's version in Settings > About Google Chrome, which will also trigger an immediate version check.

Patch guidance

Google Chrome's automatic update mechanism should deliver version 150.0.7871.47 to most users within days of release. Administrators managing Chrome through enterprise policies should verify that the 'Update policy' is set to force installation or automatic updates. For offline or restricted networks, download the Chrome installer directly from Google's official distribution channels and deploy via your software distribution system. Confirm the patch version matches or exceeds 150.0.7871.47 before considering the system remediated.

Detection guidance

Monitor for Chrome version numbers in use across your organization; any instance running 149.0.7871.46 or earlier represents unpatched exposure. Endpoint Detection and Response (EDR) tools should flag attempts to access crafted HTML payloads designed to trigger heap corruption, though signature-based detection of the payload itself is difficult without deep behavioral analysis. Focus detection efforts on unusual memory access patterns, process crashes, or unexpected child process creation originating from the browser process post-exploitation.

Why prioritize this

Despite Chromium's initial Medium rating, the CVSS 3.1 score of 8.8 (HIGH) reflects the severity of potential heap corruption impacts: full compromise of the browser process's confidentiality, integrity, and availability. The low attack complexity and requirement for only user interaction make this a credible threat in targeted and mass-exploitation scenarios. Organizations should prioritize this patch within their standard browser update cycle, treating it as a high-priority item due to its role as an attack vector for credential theft and code execution.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a score of 8.8 because the vulnerability offers network-based attack delivery (AV:N), requires low complexity exploitation (AC:L), no privilege escalation (PR:N), and—critically—can fully compromise confidentiality (C:H), integrity (I:H), and availability (A:H) of the affected process. The requirement for user interaction (UI:R) prevents a perfect 10.0 score, but does not substantially lower the severity given how easily users can be socially engineered into visiting malicious pages.

Frequently asked questions