CVE-2026-14039: Chrome Same-Origin Policy Bypass in GetUserMedia

Technical summary

The vulnerability stems from insufficient policy enforcement in the GetUserMedia API, which handles access to user media devices like cameras and microphones. A remote attacker can craft a malicious HTML page that, when visited by a user, bypasses the same-origin policy (SOP)—a fundamental security boundary in web browsers that prevents scripts from one origin from accessing data belonging to another origin. The attack vector is network-based with low attack complexity, requiring only user interaction (visiting the page). The vulnerability is classified under CWE-346 (Origin Validation Error), indicating the root cause is improper validation or enforcement of origin boundaries. No authentication is required from the attacker's perspective.

Business impact

This vulnerability could allow an attacker to interfere with the integrity of user sessions or data in ways that violate browser security assumptions. If an attacker can bypass the same-origin policy via a crafted page, they may be able to access or manipulate media streams, intercept permissions, or perform actions that appear to originate from a trusted domain. For organizations relying on browser-based security boundaries—such as SaaS platforms handling sensitive communications or video conferencing—this represents a breach of a core trust assumption. The requirement for user interaction (visiting a malicious site) limits the attack surface but does not eliminate it, particularly in phishing or social engineering scenarios.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all stable, beta, and development releases below this version number. Users on any platform (Windows, macOS, Linux, Android, iOS) running vulnerable Chrome versions are at risk if they visit a malicious website. Organizations with unpatched Chrome deployments should prioritize inventory of affected users.

Exploitability

Exploitability is moderate. The attack requires a remote attacker to craft a malicious HTML page and convince or trick a user into visiting it—a social engineering or phishing component is necessary. There is no remote code execution, no privilege escalation, and no denial of service; the impact is limited to integrity violations related to the same-origin policy. The attack does not work on passive browsing or without user action. Chromium's internal severity rating of 'Low' suggests Google's security team considers the practical attack scenarios limited, but the CVSS 4.3 score reflects the network attack vector and low barrier to crafting the exploit page.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update mechanism should deliver the patch to most users, but verification is recommended for enterprise deployments. No workarounds are available; patching is the only mitigation. Organizations should verify patch deployment status and ensure users are running the fixed version.

Patch guidance

Patch version 150.0.7871.47 addresses this vulnerability. Verify the installed Chrome version by navigating to chrome://settings/help in the browser; if the version is below 150.0.7871.47, update immediately. For enterprise environments, leverage Chrome policy settings (such as through Google Workspace or third-party device management) to enforce automatic updates or enforce a minimum version requirement. Test the patch in a limited environment before broad rollout if organizational policy requires it, though this is a critical security update and delay is not recommended.

Detection guidance

Detection of active exploitation is difficult at the network level because the attack relies on a user visiting a malicious site—traffic appears to be normal browser activity. Endpoint detection strategies include: monitor Chrome version inventory across the organization to identify machines below version 150.0.7871.47; review browser security logs for any console errors or permission denial patterns related to GetUserMedia; and educate users to avoid clicking suspicious links that may host the malicious HTML. Web traffic logs may reveal access to known malicious domains, but the vulnerability itself does not create a distinctive network signature.

Why prioritize this

Although Chromium's internal severity is 'Low' and the CVSS is 4.3 (Medium), prioritization should focus on patch deployment speed and user awareness. The attack requires user interaction, limiting exposure compared to network-based flaws. However, same-origin policy bypasses are fundamental security boundary violations and should not be tolerated in production environments. Organizations should patch all user-facing Chrome instances and conduct a one-time verification sweep within 2–4 weeks. This is not an emergency-grade vulnerability requiring immediate incident response, but it is a mandatory patch cycle item.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) is calculated using: Attack Vector Network (increases score), Attack Complexity Low (increases score), Privileges Required None (increases score), User Interaction Required (decreases score), Scope Unchanged, and Confidentiality/Integrity impact (integrity compromised, confidentiality not). The score reflects the ease of crafting and delivering the attack and the integrity impact of the policy bypass, balanced by the user interaction requirement. The disparity between Chromium's 'Low' internal rating and CVSS 'Medium' is not unusual; CVSS emphasizes ease of exploitation, while vendor severity often weighs practical exploitability and real-world prevalence.

Frequently asked questions