CVE-2026-14011: Chrome SurfaceCapture Out-of-Bounds Read – CVSS 8.1 High

Technical summary

CVE-2026-14011 is an out-of-bounds read vulnerability (CWE-125) affecting Google Chrome's SurfaceCapture functionality. The flaw allows remote code execution context to read memory beyond allocated buffer boundaries. The attack vector is network-based with low complexity; exploitation requires only user interaction (visiting a crafted webpage) and no special privileges. The vulnerability does not permit privilege escalation or lateral movement, but it does expose sensitive in-memory data that may include session tokens, encryption keys, or other confidential information. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H indicates high confidentiality and availability impact within the affected process scope.

Business impact

This vulnerability poses a meaningful threat to organizations whose users browse the internet with Chrome. An attacker can harvest sensitive data from browser memory—including cached credentials, OAuth tokens, or API keys—by hosting a weaponized webpage or compromising a legitimate site. The availability impact suggests the vulnerability may also trigger process crashes, degrading user productivity. Financial services, healthcare, and other data-sensitive sectors face elevated risk if employees use Chrome to access privileged systems or handle confidential information.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all stable, beta, dev, and canary releases published before the fix. The SurfaceCapture component is part of Chrome's graphics and display pipeline, meaning all platforms (Windows, macOS, Linux, Android, iOS) running affected versions are potentially vulnerable. Organizations should inventory Chrome deployments across endpoints, Chromebooks, and mobile devices.

Exploitability

The vulnerability requires minimal attacker effort. No advanced exploitation knowledge, valid credentials, or local file access is needed. An attacker simply crafts an HTML page containing SurfaceCapture operations that trigger the out-of-bounds read, then distributes the link via email, compromised ad network, or drive-by download. User interaction—clicking a link or visiting a site—is mandatory, but this is a low bar in real-world attack scenarios. The lack of KEV inclusion indicates no active in-the-wild exploitation had been widely reported at publication time, though this does not guarantee future safety.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism typically rolls out fixes within 24–48 hours of release for most users, but verify completion via the About Chrome menu. Organizations managing Chrome through enterprise policies (via Google Admin Console or mobile device management) should push updates immediately. Users unable to update immediately should avoid visiting untrusted websites and disable Flash/plugins if feasible. Verify patch installation by confirming version number and monitoring for crash reports that might indicate exploitation attempts.

Patch guidance

Google Chrome 150.0.7871.47 addresses this vulnerability. Check your current version in Settings → About Chrome (or chrome://version/), which will auto-update if available. Enterprise admins should validate rollout via the Admin Console and use Chrome policies to enforce updates. For managed Chromebooks, push updates through mobile device management. No manual workarounds exist; patching is the only mitigation. Organizations should prioritize update deployment within 48 hours of the patch release date.

Detection guidance

Monitor Chrome crash logs and renderer process terminations, which may indicate exploitation attempts. Network-based detection is difficult because the attack occurs entirely within the HTML/JavaScript context. Endpoint detection should flag suspicious SurfaceCapture API calls combined with process memory access patterns, though this requires advanced behavioral analytics. Consider blocking high-risk sites known to host malicious content and educate users to avoid clicking suspicious links. If available, enable Chrome's built-in sandboxing and Safe Browsing features to add additional layers of protection.

Why prioritize this

Although Chromium assigned this a Medium severity rating internally, the CVSS 8.1 score and high confidentiality impact warrant immediate prioritization. The ease of exploitation (network-based, low complexity, user-interaction required but common) combined with the ability to exfiltrate sensitive data makes this a high-priority patch target. The absence of a current KEV entry provides a narrow window before widespread exploitation; proactive patching is critical.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network attack vector with no special access or privileges required; (2) Low complexity exploitation; (3) Mandatory user interaction, which is present in many real-world scenarios; (4) High confidentiality impact (exposure of sensitive memory); (5) High availability impact (process crashes). The score does not account for impact (integrity is not affected), nor does it reflect scope escape or privilege escalation, both absent here. This aligns with a substantial but not critical risk posture.

Frequently asked questions