CVE-2026-14015: Chrome WebRTC Race Condition Leaks Cross-Origin Data on Windows

Technical summary

CVE-2026-14015 is a race condition (CWE-362) in the WebRTC subsystem of Google Chrome on Windows. The vulnerability exists in versions prior to 150.0.7871.47 and stems from improper synchronization during WebRTC session initialization or audio/video stream processing. An unauthenticated network attacker can trigger cross-origin data leakage by hosting a specially crafted HTML page that exploits the timing window. The attack requires user interaction (UI=R per CVSS vector) but does not require authentication or elevated privileges. The window of exploitability is narrow due to the race condition's nature, making reliable exploitation dependent on precise timing.

Business impact

Data confidentiality is the primary concern. Depending on what cross-origin data is accessible through WebRTC contexts, an attacker could potentially extract session tokens, personal information, or other sensitive data from simultaneous browser sessions. The impact is mitigated by the requirement for user interaction and the unpredictable nature of race conditions, which may limit real-world attack success rates. Organizations relying on Chrome for sensitive work should treat this as a confidentiality risk, especially for users who may visit untrusted websites or fall victim to social engineering. Patching timely reduces exposure window.

Affected systems

Google Chrome on Microsoft Windows, versions before 150.0.7871.47, are vulnerable. Users on macOS, Linux, and Chrome OS should verify their browser version status against official vendor guidance, as the advisory specifically identifies Windows as the affected platform. The vulnerability does not affect Chrome on other operating systems based on the stated scope. Enterprise deployments using Chrome on Windows for web-based applications handling sensitive data are in scope.

Exploitability

Exploitability is moderate. The attack requires a network-accessible attacker and victim interaction (user must visit the malicious page), but does not require the victim to take additional action beyond navigation. No authentication bypass or privilege escalation is needed. The race condition's nature introduces timing-dependent reliability—not all attempts may succeed, and exploitation windows may be measured in milliseconds. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, suggesting active in-the-wild exploitation has not been widely reported at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For Windows deployments, this patch is critical and should be deployed promptly given the cross-origin data leakage risk. Chrome's automatic update mechanism will push the patch to most users, but administrators should verify deployment in managed environments. No workarounds are available; patching is the only remediation.

Patch guidance

Install Google Chrome 150.0.7871.47 or any subsequent stable release. Most users on auto-update will receive the patch automatically within hours to days of release. Enterprise administrators should verify patch deployment through Chrome's management console or by checking chrome://version in the browser address bar. Test patched versions in non-production environments first if Chrome is critical to business applications. No rollback concerns are expected, as this is a security-only patch in a minor version bump.

Detection guidance

Monitor for Chrome updates in your environment and verify successful installation via endpoint management tools or by querying browser version through scripts. At the network level, look for WebRTC signaling traffic to suspicious or unexpected domains, though this requires context around expected usage. Host-based indicators are difficult to extract post-exploitation due to the race condition's transient nature. Focus detection efforts on ensuring compliance with patch deployment rather than hunt-based approaches. If WebRTC usage can be restricted through policy in your environment (e.g., disabling WebRTC for high-risk users), consider that as a temporary defense while patching rolls out.

Why prioritize this

Although this is a CVSS 6.5 Medium severity issue, it should be prioritized for prompt patching because (1) it enables cross-origin data leakage, a direct confidentiality violation; (2) the attack vector is network-based with low complexity, meaning widespread campaigns are feasible; (3) user interaction is required but is easily satisfied through social engineering or drive-by visits; (4) Chrome is ubiquitous, creating a large attack surface. Race conditions in security-critical code paths, though timing-dependent, warrant urgent remediation. Prioritize Windows-based Chrome deployments in your organization.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating driven by the confidentiality impact (C:H) balanced against the requirement for user interaction and the lack of integrity or availability damage. The attack vector is Network (AV:N) and requires no special privileges (PR:N), but the user interaction requirement (UI:R) prevents a higher score. The scope is Unchanged (S:U), meaning the attacker cannot escalate privileges or affect other systems. The timing-dependent nature of the race condition is implicit in the assessment—the CVSS score assumes a competent attacker who can reliably trigger the window.

Frequently asked questions