CVE-2026-14010: Chrome Codec Memory Disclosure Vulnerability on Windows

Technical summary

CVE-2026-14010 is an uninitialized use vulnerability (CWE-457) in Chrome's codec handling subsystem on Windows. The flaw allows a remote, unauthenticated attacker to read uninitialized memory regions within the Chrome process by crafting HTML that triggers specific codec decoding paths. The memory regions are never explicitly zeroed after allocation, leaving them populated with residual data from previous process operations. An attacker exploiting this gains the ability to infer or directly observe confidential information that may have existed in those memory locations prior to the vulnerable codec operation. Chromium assigned this a Medium severity rating; the CVSS v3.1 score of 6.5 reflects high confidentiality impact with network attack vector but requiring user interaction.

Business impact

A successful attack could result in the disclosure of sensitive user data processed by Chrome, including but not limited to cached credentials, session tokens, API keys, or fragments of user documents. Organizations where employees rely on Chrome for accessing web applications face potential credential compromise if users are lured to malicious sites. The requirement for user interaction (visiting a crafted page) means broad, untargeted attacks are less likely, but targeted phishing campaigns could be effective. The impact is primarily confidentiality; integrity and availability of the system are not affected.

Affected systems

This vulnerability affects Google Chrome versions prior to 150.0.7871.47 running on Windows systems. Chrome on other operating systems (macOS, Linux, Android) is not mentioned in the advisory and is presumed unaffected by this specific codec memory disclosure. Users on Windows who have not yet updated to version 150.0.7871.47 or later are at risk.

Exploitability

Exploitation requires network access and user interaction—specifically, a user must visit or be redirected to a crafted HTML page. Once loaded, the malicious page performs codec operations that trigger the uninitialized memory access. No authentication, special privileges, or local access is required on the attacker side. The attack surface is broad because any webpage can deliver the exploit, making phishing, watering-hole attacks, and advertisement injection viable delivery methods. However, the vulnerability is not remotely exploitable without user involvement, which provides a modest mitigation factor.

Remediation

The definitive fix is to update Google Chrome on Windows to version 150.0.7871.47 or later. Chrome's autoupdate mechanism should deploy patches automatically; users can also manually verify their version by navigating to chrome://settings/help. For organizations managing Chrome deployments, ensure that automatic updates are enabled or that deployment mechanisms deliver the patched version. Until patching is complete, user awareness training to avoid suspicious links is a secondary control, but it is not a reliable substitute for patching.

Patch guidance

Google has released Chrome 150.0.7871.47 for Windows as the corrected version. Users should check their Chrome version under Settings > About Chrome; the browser will automatically download and install updates if automatic updates are enabled. On systems where autoupdate is disabled, users or administrators must manually trigger an update check. For enterprise deployments, administrators should use Chrome's update policies (e.g., via Group Policy on Windows domains) to ensure timely rollout. Verify that the version string shows 150.0.7871.47 or higher before considering the patch applied.

Detection guidance

Detection at the endpoint level is challenging because the exploit does not leave traditional artifacts like file modifications or process crashes. Monitor for suspicious HTML or script execution within Chrome using browser isolation solutions or sandboxing where available. Web application firewalls (WAFs) may detect patterns in requests that deliver the crafted HTML, though the payload itself is likely obfuscated or distributed via legitimate hosting. EDR (Endpoint Detection and Response) tools should flag any attempts to exfiltrate large volumes of data from Chrome processes, though the amount of leaked data per exploit is likely small. The most practical detection is version scanning: ensure all Windows systems have Chrome version 150.0.7871.47 or later. Monitor Chrome crash reports for patterns of codec-related exceptions if available through your organization's crash reporting infrastructure.

Why prioritize this

This vulnerability merits expedited patching due to its network attack vector, the prevalence of Chrome, and the potential for data exfiltration. Although CVSS is 6.5 (Medium), the practical risk is elevated because Chrome is heavily used for web access, and the data disclosed could include credentials or other high-value secrets. The requirement for user interaction reduces urgency slightly compared to wormable vulnerabilities, but the ease of delivery via phishing makes it a credible threat. Organizations should prioritize patching Windows systems with Chrome within 1–2 weeks of release.

Risk score, explained

The CVSS 6.5 score reflects: network attack vector (AV:N, +1 point), low attack complexity (AC:L, +0 points), no privilege required (PR:N, +0 points), user interaction required (UI:R, -0.5 points), unchanged scope (S:U, +0 points), high confidentiality impact (C:H, +1 point), no integrity impact (I:N, +0 points), and no availability impact (A:N, +0 points). The score appropriately captures the risk of memory disclosure but does not account for the specific sensitivity of Chrome's role in credential storage and web access; in many organizations, the actual business risk is higher than the base CVSS suggests.

Frequently asked questions