CVE-2026-14049: Chrome GPU Memory Disclosure Vulnerability – Patch 150.0.7871.47

Technical summary

CVE-2026-14049 is an information disclosure vulnerability in the GPU implementation within Chromium's rendering engine. The flaw stems from an inappropriate implementation that fails to properly isolate or protect sensitive data during GPU operations. An attacker with code execution in the renderer process can craft a malicious HTML page that exploits this weakness to read memory contents that would normally be inaccessible. The vulnerability is classified as CWE-200 (Information Exposure) and requires the renderer process to already be compromised, making it a post-compromise information leakage risk rather than a direct entry point.

Business impact

While this vulnerability requires an already-compromised renderer process, it poses a real risk to organizations where Chrome is the primary browser. If an attacker has gained code execution within the browser (through a separate exploit or social engineering), this flaw enables them to extract sensitive information—such as authentication tokens, cached credentials, or other data in process memory—that could facilitate lateral movement or data exfiltration. The requirement for user interaction (visiting a crafted page) adds friction but is often achievable through phishing or malicious advertising. Organizations handling high-value data should prioritize patching.

Affected systems

The vulnerability affects Google Chrome prior to version 150.0.7871.47. Since Chrome is cross-platform, all instances running affected versions on Windows, macOS, and Linux are vulnerable. The issue does not appear to be specific to any particular CPU architecture or GPU vendor, though the exploitation path requires the Chrome renderer process to be the attack vector.

Exploitability

Exploitation is not trivial. An attacker must first achieve code execution within Chrome's renderer process—typically through a separate browser vulnerability or supply-chain compromise—and then serve a specially crafted HTML page to the target. The user must also visit the malicious page. While the CVSS score reflects a medium severity with high confidentiality impact, the requirement for prior compromise and user interaction reduces the practical attack surface compared to remote code execution vulnerabilities. This is a lateral-movement or data-exfiltration tool rather than an initial access vector.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This patch addresses the GPU implementation flaw and eliminates the memory disclosure pathway. Organizations should push this update through their patch management systems immediately. Verify deployment across all managed Chrome instances, including those on enterprise devices and Chromebooks if applicable.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later. Most organizations using Chrome rely on the browser's automatic update mechanism, which should roll out this patch within days of release. For enterprise environments using Chrome policies or managed deployment, explicitly push the update to accelerate adoption. Test in a limited group first if your organization has strict change control; no known compatibility issues are reported for this patch. Verify installation by checking the browser version in chrome://version after restart.

Detection guidance

Monitor for Chrome versions older than 150.0.7871.47 in your environment using endpoint detection and response (EDR) tools or asset inventory systems. Since the vulnerability requires renderer process compromise as a precondition, detecting its exploitation is difficult without behavioral analysis. Look for unusual GPU-related system calls or memory access patterns in Chrome processes if you suspect an already-compromised system. Browser crash logs and renderer process dumps may contain artifacts if exploitation is attempted. Prioritize patching over attempting to detect active exploitation.

Why prioritize this

Although Chromium labeled this a low-severity issue, the CVSS score reflects a medium severity due to high confidentiality impact. The primary limiting factor is that exploitation requires an already-compromised renderer process, which lowers the attack likelihood. However, in a threat landscape where browser exploits are common, this vulnerability should be prioritized for patching because it enables attackers to extract high-value information once inside Chrome. Organizations with users who browse untrusted content or handle sensitive credentials should treat this as a near-term priority.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium severity) reflects: high confidentiality impact (an attacker can read memory), no integrity or availability impact, network-based attack vector, high attack complexity (requires renderer compromise plus crafted HTML), no privileges required for the network request, user interaction required (user must visit the page), and unchanged scope. The score appropriately penalizes exploitability difficulty while acknowledging the real information disclosure risk. Organizations may adjust their internal risk rating based on Chrome's criticality in their environment and the types of data accessible to Chrome processes.

Frequently asked questions