CVE-2026-14040: Google Chrome BrowserTag Use-After-Free Vulnerability (CVSS 8.8)

Technical summary

This vulnerability is a use-after-free (CWE-416) flaw in Chrome's BrowserTag functionality. Use-after-free defects occur when code attempts to access memory that has already been freed, potentially allowing attackers to read sensitive data or execute arbitrary code by controlling what occupies that freed memory region. The attacker must deliver a malicious Chrome extension to the target user; the extension then triggers the heap corruption through a crafted payload. The high CVSS score (8.8) indicates potential for confidentiality, integrity, and availability impact with network accessibility and low attack complexity, though successful exploitation depends on social engineering to install the extension.

Business impact

Successful exploitation could lead to complete compromise of the affected Chrome browser process, potentially exposing sensitive user data, credentials, and browsing history stored in memory. For organizations with users who install extensions from untrusted sources or have weak extension governance policies, this represents a pathway for targeted attacks. The attack surface is limited by the social engineering requirement, but determined adversaries could use deceptive distribution or legitimate-looking extensions to reach users. Enterprises should assess extension policies and user awareness training as mitigating controls.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all stable release builds below that version number across Windows, macOS, and Linux platforms. Chromium-based browsers that embed Google's security patches may also be affected depending on their release cycle and vendor response time. Verify your organization's Chrome version and auto-update status to determine exposure.

Exploitability

Exploitation requires both a malicious extension and user interaction to install that extension. While the technical barrier for crafting the malicious extension is moderate (requiring knowledge of Chrome internals and heap layout), the social engineering requirement—convincing a user to install an untrusted extension—is typically the limiting factor. This is not a zero-click vulnerability. The attack does not require user privileges beyond normal browser usage, and once the extension is installed, triggering the vulnerability is likely deterministic.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism should deliver this patch automatically; however, users must restart the browser for the patch to take effect. Additionally, implement or reinforce extension governance policies to restrict installation of extensions outside your organization's approved catalog. Consider disabling third-party extension installation entirely in managed environments where business requirements permit.

Patch guidance

Verify that your Chrome installations are running version 150.0.7871.47 or higher. Users can check their version by navigating to Chrome menu > About Chrome, which will also trigger an immediate update check. For managed Chrome deployments, use your enterprise management console (Google Admin Console or MDM platform) to monitor version compliance and enforce auto-update policies. Test the patched version in a non-production environment if your organization has critical extension dependencies that might be affected by the update.

Detection guidance

Monitor for unusual Chrome extension installations, particularly those from non-standard sources or with broad permissions. Log extension installation events in managed environments via your endpoint detection and response (EDR) platform or Chrome Management console. Detect attempts to access the Chrome Web Store from suspicious IP ranges or at unusual times. Network-level indicators are limited since the attack occurs entirely within the browser process; focus detection efforts on extension audit logs, process dumps from crashed Chrome instances, and user reports of unexpected behavior.

Why prioritize this

Although the Chromium team rated this as low severity, the CVSS 3.1 score of 8.8 reflects realistic impact potential: an attacker can achieve confidentiality, integrity, and availability compromise with network accessibility and low attack complexity. The primary limiting factor is the social engineering requirement to install the malicious extension. Organizations with strong extension governance and user training may deprioritize relative to zero-click or unauthenticated network vulnerabilities, but high-risk users (journalists, activists, executives) warrant expedited patching. The timeline from publication (June 30, 2026) to patch availability was rapid, reducing exploitation window.

Risk score, explained

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 8.8 (HIGH). Network accessibility and low attack complexity reflect that the vulnerability can be triggered over the internet via a malicious extension without elevated privileges. User interaction (UI:R) is required to install the extension. The high impact scores for confidentiality, integrity, and availability are justified because successful exploitation can corrupt heap memory, potentially leading to arbitrary code execution and complete process compromise. The lack of scope change (S:U) indicates the impact is limited to the Chrome process itself, not the wider system, which prevents a critical rating.

Frequently asked questions