CVE-2026-14045: Chrome Cross-Origin Data Leak via Renderer Compromise

Technical summary

CVE-2026-14045 stems from insufficient input validation in Chrome's Network component. The vulnerability permits a compromised renderer process to exfiltrate cross-origin data through a specially crafted HTML page. The renderer, already operating under attacker control, can bypass the Same-Origin Policy protections that isolate data between different websites. The issue affects Chrome versions prior to 150.0.7871.47 and is classified as CWE-20 (Improper Input Validation). Google assigned this a Low severity rating internally, though the CVSS 3.1 score of 4.3 reflects the confidentiality impact and network-based attack surface.

Business impact

The practical risk depends on your organization's threat model. If your concern is preventing initial compromise, this vulnerability alone does not grant remote code execution—it requires an attacker to already control the renderer process. However, in advanced attacks where an adversary has achieved code execution in Chrome, this flaw provides an additional avenue to harvest sensitive user data, session tokens, or authentication credentials from cross-origin sites. For enterprises with high-value targets or users handling sensitive financial or medical data, this compounds the damage from an already-compromised browser.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all older stable, beta, and development channels. Chrome on Windows, macOS, Linux, Android, and iOS versions before the patched release are in scope. Organizations using Chromium-based browsers (Edge, Brave, Opera, etc.) may face similar exposure depending on whether those vendors backport the fix; verify with each vendor's advisory.

Exploitability

Exploitation requires two conditions: (1) the attacker must first compromise the Chrome renderer process, and (2) the user must visit a malicious webpage. The renderer compromise typically requires a separate exploit—such as a use-after-free, type confusion, or sandbox escape in Chrome itself or a plugin. Once that prerequisite is met, triggering the data leak via a crafted HTML page requires only user interaction (visiting a webpage), which is low effort. The CVSS vector reflects these constraints: the attack requires no privileges (PR:N) and user interaction (UI:R), but is network-accessible (AV:N) with low attack complexity (AC:L).

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome automatically checks for updates on startup and typically applies them after restart. For managed environments, deploy the latest version via your enterprise deployment tool (such as ADMX templates for Windows or MDM for mobile). Verify the update has been applied using Chrome's About page (chrome://about). No configuration changes or workarounds are available for unpatched versions.

Patch guidance

Roll out Chrome 150.0.7871.47 or later to all endpoints. Prioritize user-facing devices and developer workstations that browse untrusted websites. For Chromebook deployments, enable auto-updates and confirm all devices have checked in within 24 hours. For enterprise Chrome on Windows/Mac, use your standard desktop deployment pipeline; Google provides ADMX templates to enforce updates. On mobile, ensure MDM policies mandate the latest Play Store or App Store version. Test the update in a non-production environment first if you have custom Chrome extensions that may have compatibility concerns.

Detection guidance

Detection of active exploitation is difficult without access to renderer process memory or detailed network telemetry. However, monitor for: (1) unusual cross-origin data requests from Chrome (e.g., a single tab making requests to unrelated domains), (2) network traffic patterns inconsistent with user browsing behavior, (3) Chrome crash dumps or renderer process restarts (which may indicate exploitation attempts or the prior compromise that enabled this attack). SIEM rules should flag any Chrome instances attempting to exfiltrate data across security boundaries if you have endpoint visibility into network policies.

Why prioritize this

Although the CVSS score is moderate (4.3), prioritize patching because this vulnerability bridges a critical gap for attackers who have already achieved renderer-level code execution. It transforms a renderer compromise from stealing data only within that tab into a cross-site data harvesting tool. Any organization that views renderer exploits as a realistic threat model—particularly those in high-value sectors or handling sensitive data—should treat this as high priority. The fix is straightforward and automatic, lowering remediation friction.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: (1) Network-based attack surface (AV:N), (2) Low attack complexity and no privilege requirement, reducing barrier to exploitation once renderer is compromised, (3) User interaction required (UI:R) to visit the malicious page, (4) Confidentiality impact (C:L) allowing leakage of cross-origin data, (5) No integrity or availability impact. The score appropriately downgrades the risk relative to remote code execution flaws because the prerequisite renderer compromise is the harder part; this vulnerability is the 'follow-up' payload. However, in a chain attack where initial compromise is delivered via phishing or watering hole, this flaw becomes a high-value secondary stage.

Frequently asked questions