CVE-2026-14027: Chrome Use-After-Free Sign-In Heap Corruption – CVSS 8.8 HIGH

Technical summary

CVE-2026-14027 is a use-after-free vulnerability (CWE-416) in the SignIn component of Google Chrome versions prior to 150.0.7871.47. The flaw occurs when memory is accessed after it has been freed, enabling heap corruption. An attacker can craft a malicious HTML page that, when combined with specific user UI interactions during sign-in, triggers the use-after-free condition. This heap corruption can escalate to arbitrary code execution in the Chrome process context. The vulnerability requires user interaction but has a low attack complexity, making it practically exploitable.

Business impact

Successful exploitation could lead to unauthorized access to user credentials stored in the browser, theft of sensitive data, installation of malware, or lateral movement within corporate networks if an employee's Chrome instance is compromised. Organizations relying on Chrome for corporate productivity face potential credential harvesting and data exfiltration risks. The requirement for user interaction slightly limits enterprise-wide exposure compared to wormable vulnerabilities, but phishing campaigns targeting sign-in flows could achieve broad impact.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes stable releases, extended stable releases, and any derivative browsers built on Chromium with this code path unpatched. Enterprise deployments using Chrome and Chromium-based browsers are within scope.

Exploitability

Exploitation requires network access and user interaction—specifically, convincing a user to visit a malicious page and perform targeted UI gestures during sign-in. The low attack complexity and absence from CISA's KEV catalog suggest active exploitation may be limited, but the barrier to weaponization is moderate. Phishing or watering-hole attacks could reliably deliver the crafted HTML and social-engineer the necessary user actions.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Verify the update through Settings > About Google Chrome, which auto-updates and confirms the installed version. For enterprise environments, deploy the patch via your Chrome management policy to all endpoints. No workarounds are available; patching is the only mitigation.

Patch guidance

1. For individual users: Open Chrome Settings, navigate to 'About Chrome,' and allow automatic update to complete. Restart the browser once the update is installed. 2. For enterprises: Use Chrome's admin console or Group Policy to force update deployment to version 150.0.7871.47 or later. Confirm patch deployment within 7 days of release. 3. Verify: Check chrome://version to confirm the running version matches or exceeds 150.0.7871.47.

Detection guidance

Monitor for anomalous Chrome process behavior post-sign-in, including unexpected child process creation, file system modifications, or network connections initiated from the Chrome sandbox. Endpoint Detection and Response (EDR) tools should flag heap corruption attempts and use-after-free patterns. Network-level detection is limited since the attack occurs client-side; focus on behavioral signals and patching compliance reporting.

Why prioritize this

Although Chromium rates this as low severity, the CVSS 3.1 score of 8.8 reflects the true impact: a use-after-free leading to heap corruption with potential for code execution. The requirement for user interaction prevents automatic worm-like spread but does not diminish the severity once a user is socially engineered. Organizations should prioritize patching within 7–14 days, especially for users in security-sensitive roles.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) accounts for network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction (UI:R), impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The discrepancy with Chromium's 'Low' rating likely reflects Chromium's narrower assessment of exploitability in practice; the CVSS score appropriately captures the severity of heap corruption leading to code execution.

Frequently asked questions