CVE-2026-14019: Google Chrome Password Manager Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-14019 is a cross-origin data leak vulnerability in the password management component of Google Chrome. The root cause stems from inappropriate implementation logic that failed to properly isolate sensitive data across origin boundaries. An attacker could craft a malicious HTML page that, when visited by a user, triggers the password manager to inadvertently expose information from a different origin. The vulnerability is classified as CWE-522 (Inadequate Logging), reflecting insufficient safeguards in how sensitive credential-related data is handled. The attack surface is the network (AV:N), requires no special conditions beyond low complexity (AC:L), requires no prior authentication (PR:N), and necessitates user interaction (UI:R). The impact is limited to confidentiality (C:H), with no integrity or availability consequences.

Business impact

This vulnerability poses a meaningful risk to organizations and users whose sensitive data could be harvested through credential exposure. Threat actors could conduct targeted phishing or credential harvesting campaigns by distributing malicious pages via email, social engineering, or compromised websites. Financial services, healthcare, and other credential-heavy sectors are particularly exposed. The requirement for user interaction makes mass exploitation less likely than network-only flaws, but the high confidentiality impact means a single successful compromise of a user's browser session could yield valuable credentials or authentication tokens. Organizations managing shared browser deployments or enforcing password manager usage should prioritize remediation.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. This includes all stable, beta, dev, and canary channel releases before the patched version. Chromium-based browsers that incorporate the vulnerable password manager logic may also be affected—verify with your browser vendor if you use Chrome derivatives (Edge, Brave, Opera, etc.). Chrome on all supported operating systems (Windows, macOS, Linux, Android, iOS) is in scope.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker needs only to host or distribute a crafted HTML page and wait for a user to visit it. No browser plugins, extensions, or complex prerequisites are required. The barrier is social engineering—convincing a user to click the link—rather than technical complexity. Active exploitation is plausible but not widespread, and no public exploit code or proof-of-concept was known at the time of publication. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) list, suggesting in-the-wild exploitation had not been formally documented as of the advisory date.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism should deliver the patch automatically, but users can manually verify their version via Settings > About Google Chrome. For organizations with centralized browser management, deploy the patched version through your standard update channels. Chromium-based browser users should check their respective vendor advisories for patch availability and timelines. No workarounds are available; patching is the only mitigation.

Patch guidance

Deploy Chrome 150.0.7871.47 or higher across your user base. Organizations using Google Chrome Enterprise or managed Chrome policies should push the update through your Mobile Device Management (MDM) or configuration management system. Most Chrome installations update automatically; however, verify completion by sampling a few endpoints and confirming version numbers. For Chromium-based alternatives (Microsoft Edge, Brave, etc.), follow each vendor's patching schedule and advisory. If you maintain any custom Chromium builds, apply the equivalent security patch from the Chromium project's security fix tracker.

Detection guidance

Detection at the network level is difficult because the attack relies on legitimate browser traffic to a malicious website. Endpoint detection should focus on behavioral monitoring: watch for unusual password manager activity, unexpected credential submission failures, or anomalous authentication events shortly after users visit untrusted domains. Log authentication failures and credential-related errors in your IAM or SIEM platform. If you suspect exposure, monitor for unauthorized account access attempts using harvested credentials. Security teams can also track Chrome version numbers in their endpoint telemetry to confirm patch compliance; older Chrome versions should trigger remediation alerts.

Why prioritize this

Although classified as CVSS Medium (6.5), this vulnerability merits prompt prioritization because it directly threatens credential security—a foundational trust anchor. The attack vector is network-accessible and user-interaction-driven, making it suitable for phishing or social engineering campaigns. Organizations with high-value users (executives, financial administrators, developers with privileged accounts) should prioritize patching those systems first. The lack of KEV documentation suggests active exploitation may be limited, but the potential for targeted campaigns is real. Routine deployment through your standard patch cycle is appropriate, but do not deprioritize in favor of lower-impact flaws.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible vulnerability with low attack complexity and user interaction, resulting in high confidentiality impact but no integrity or availability damage. The score correctly captures that an unauthenticated remote user can leak sensitive data through a crafted webpage. However, the user-interaction requirement and absence of active exploitation lower the practical urgency slightly below Critical or High-severity thresholds. For organizations where user credentials are a primary attack target, consider this a borderline Medium-to-High priority when combined with your threat modeling.

Frequently asked questions