CVE-2026-14016: Chrome SVG Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-14016 is a cross-origin data leak vulnerability in Chrome's SVG implementation caused by an inappropriate implementation that fails to properly enforce origin isolation. The vulnerability is triggered through a crafted HTML page and leverages SVG processing to sidestep same-origin policy protections. Classified as CWE-352 (Cross-Site Request Forgery-adjacent design flaw), the vulnerability requires user interaction (visiting the malicious page) but does not require special privileges and operates over the network. The Chromium security team assigned a Medium severity rating.

Business impact

A successful exploit could expose sensitive user data across multiple websites, including personal information, session data, or private content accessible within the user's browsing context. For organizations, this creates risk in two vectors: (1) employee browsing of attacker-controlled sites could leak internal or sensitive corporate data cached in the browser, and (2) public-facing web applications may be targets for attackers seeking to extract user data. The data exfiltration is confidentiality-focused; integrity and availability are not compromised.

Affected systems

Google Chrome browser prior to version 150.0.7871.47 is affected. Users on Windows, macOS, Linux, Android, and iOS running vulnerable Chrome versions should prioritize patching. Chromebook devices and enterprise Chrome instances are also in scope. The vulnerability does not affect other Chromium-based browsers unless they have independently integrated the same flawed SVG code path.

Exploitability

The attack requires a remote, unauthenticated actor to craft and host a malicious HTML/SVG page, then socially engineer or otherwise redirect a user to visit it. No special user privileges are needed on the victim's machine. The barrier to exploitation is relatively low—crafting the payload is likely straightforward given the SVG vector—and the attack surface is broad (any website visit). However, the requirement for user interaction (visiting the attacker's site) and the medium CVSS score (6.5) reflect that exploitation is not trivial or zero-click. No public exploit code or CISA KEV listing has been reported at this time.

Remediation

Update Google Chrome to version 150.0.7871.47 or later as soon as possible. Organizations managing Chrome through policy (via Google Admin Console or domain-group policy) should deploy the update through their standard patch management workflows. Users should enable automatic updates in Chrome settings if not already enabled. For enterprise deployments, verify update completion within 48–72 hours of release; consider blocking older Chrome versions via policy if feasible.

Patch guidance

Google Chrome automatically prompts users to update when a new version is available; most users will receive version 150.0.7871.47 and above through Chrome's update mechanism within days of release. Administrators managing Chrome enterprise deployments should consult the Google Chrome for Business release notes and push updates via their mobile device management (MDM) or desktop management platform. Verify that auto-update is enabled or manually trigger updates on client machines. For air-gapped or restricted environments, download the installer from Google's official Chrome download page and distribute through internal software repositories.

Detection guidance

Monitor for user reports of unexpected data access or suspicious browser behavior after visiting unfamiliar websites. At the network level, identify anomalous outbound connections from Chrome processes to unexpected destinations, as successful exploitation would likely exfiltrate data. Endpoint Detection and Response (EDR) tools can flag unusual SVG processing or repeated cross-origin requests from a single tab. Log Chrome version numbers across your fleet to identify machines still running pre-150.0.7871.47 builds. Encourage users to report sites that behave unusually or trigger warnings.

Why prioritize this

Although this is a Medium severity vulnerability with a CVSS of 6.5, it enables direct cross-origin data theft—a high-impact confidentiality breach—and affects nearly all Chrome users. The attack surface is wide and the user interaction barrier, while present, is low in practice. Given Chrome's ubiquity in both consumer and enterprise environments, widespread patching should begin immediately. It does not carry CISA KEV status, so it is not an imminent government-mandated priority, but the data-exfiltration risk and broad user base make it a strong candidate for rapid internal patching timelines.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity vulnerability with high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N), network-accessible attack vector (AV:N), low complexity (AC:L), no special privileges (PR:N), and user interaction required (UI:R). The score appropriately captures the seriousness of data leakage while acknowledging that user action is needed to trigger the flaw. Organizations should treat this as higher priority than the numeric score alone suggests because of the widespread deployment of Chrome and the real-world ease of driving users to attacker-controlled pages.

Frequently asked questions