CVE-2026-14022: Cross-Origin Data Leak in Google Chrome via Renderer Compromise

Technical summary

CVE-2026-14022 is a cross-origin data leak vulnerability in Chrome's network handling layer. The root cause is insufficient validation of untrusted input (CWE-20) in the Network component prior to version 150.0.7871.47. An attacker with renderer process compromise can craft HTML to bypass same-origin policy protections and read data from different origins. The attack surface requires user interaction (UI required per CVSS vector) and network accessibility, but does not require elevated privileges. Impact is confidentiality only; integrity and availability are not affected.

Business impact

For enterprise environments, this vulnerability increases the blast radius of renderer-process exploits. If an attacker chains this flaw with a separate Chrome zero-day or social engineering attack to compromise the renderer, they gain the ability to harvest sensitive cross-origin data—such as authentication tokens, CSRF cookies, or API responses—without the user's awareness. Organizations relying on browser isolation or security policies that assume renderer separation will mitigate risk should reassess their threat model and patch urgency accordingly.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. All platforms (Windows, macOS, Linux, Chrome OS, Android) running vulnerable versions are at risk. The vulnerability does not affect other Chromium-based browsers (Edge, Opera, Brave, etc.) unless they have independently failed to integrate the upstream fix; verify via vendor advisories for non-Google distributions.

Exploitability

Exploitability requires a two-stage attack: first, compromise of the Chrome renderer process (a non-trivial prerequisite), and second, user interaction to load a crafted HTML page. The CVSS score of 6.5 (Medium) reflects the high impact on confidentiality but the requirement for prior renderer compromise and user action. The vulnerability is not listed on the CISA KEV catalog, indicating no evidence of active in-the-wild exploitation at the time of publication. However, once renderer exploits are publicly available, this flaw becomes a high-value post-compromise technique.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Most users on auto-update will receive the patch automatically; verify the version in chrome://settings/help. In environments where manual deployment is required, prioritize patching all Chrome instances, especially on systems handling sensitive data or high-value targets. Supplementary controls such as Site Isolation (enabled by default in Chrome) provide defense-in-depth but should not be relied upon as a substitute for patching.

Patch guidance

Visit chrome://settings/help to verify your current version and trigger immediate updates if not yet on 150.0.7871.47 or later. For enterprise deployments using group policies, update the Chrome installer and validate via policy compliance scans. No workarounds exist; patching is the only remediation. Test in a non-production environment if you maintain custom Chrome builds or enterprise configurations before broad rollout.

Detection guidance

Monitor for successful cross-origin data access anomalies via network logs and DevTools console errors; however, a compromised renderer may suppress warnings. Behavioral indicators include unusual network traffic patterns post-compromise or large data exfiltration events from browsers to unexpected destinations. Site Isolation (chrome://flags to verify it is enabled) segments render processes by site, reducing but not eliminating risk. Deploy browser telemetry or EDR solutions that track Chrome process behavior and memory access patterns for early detection of renderer compromise.

Why prioritize this

Although this vulnerability carries a Medium CVSS score and lacks evidence of active exploitation, it is a dangerous post-compromise primitive. Its value as a second-stage attack dramatically increases the risk of any renderer exploit. Organizations should prioritize patching based on exposure to untrusted web content and the presence of known Chrome exploits in the threat landscape. High-value targets and security-conscious enterprises should treat this as high-priority to narrow the window for chained attacks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects confidentiality impact (H) with no integrity or availability loss, and the requirement for network access, low complexity, no privileges, and user interaction. While the Medium severity designation is technically accurate under CVSS, the contextual risk is elevated because: (1) renderer compromise is increasingly common via separate exploits, (2) cross-origin data exfiltration is highly damaging, and (3) the attack is invisible to end users. Risk assessment should be scoped to your threat model; organizations where renderer exploit chains are plausible should weigh this higher.

Frequently asked questions