CVE-2026-14051: Chrome GamepadAPI Memory Disclosure Vulnerability

Technical summary

CVE-2026-14051 is an uninitialized memory use vulnerability (CWE-457) in the GamepadAPI implementation within Chromium. The flaw allows a compromised renderer process to access uninitialized memory regions through a specially crafted HTML page, bypassing memory safety protections. The attack surface is limited to users who both visit a malicious page and have an already-compromised renderer, indicating this is a post-compromise information disclosure rather than a standalone remote code execution vector. Google assigned this a Low severity rating within Chromium's threat model, though the CVSS 3.1 score of 6.5 (MEDIUM) reflects network accessibility and high confidentiality impact.

Business impact

This vulnerability poses a data exfiltration risk in scenarios where Chrome's renderer process has been compromised by malware or another exploit. Affected users could have sensitive information—including cached credentials, session tokens, or personal data from browser memory—leaked to an attacker-controlled webpage. Organizations relying on Chrome for sensitive work should prioritize patching to prevent post-compromise information leakage, especially in environments where malware campaigns target browsers as a secondary exploitation stage.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on all supported platforms (Windows, macOS, Linux) are vulnerable. The vulnerability is present in the Chromium browser engine, affecting Chrome and potentially other Chromium-based browsers. No evidence of exploitation in the wild has been reported.

Exploitability

Exploitation requires two preconditions: (1) the attacker must have already compromised the renderer process, and (2) the user must visit a crafted HTML page. This two-stage requirement significantly limits attack scope. The vulnerability is not trivial to exploit—it demands precise knowledge of memory layout and renderer state—but once renderer compromise is achieved, weaponization becomes straightforward. The vector indicates network accessibility with low attack complexity once prerequisites are met.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Users on Windows, macOS, and Linux should enable automatic updates or manually check for the latest version. Chromium-based browsers should consult their respective vendors for patch availability and timelines. No workaround exists; patching is the only mitigation.

Patch guidance

Chrome typically auto-updates on most platforms. Verify the installed version by navigating to Chrome Settings > About > Chrome. The browser will report the current version and initiate updates automatically if not on the latest build. Organizations managing Chrome deployments should verify patch application across endpoints and consider forcing updates via Group Policy (Windows) or Mobile Device Management (MDM) for managed devices. Prioritize patching for systems handling sensitive data or exposed to high-risk browsing scenarios.

Detection guidance

Monitor Chrome version compliance across endpoints to identify unpatched systems. Detection at runtime is difficult, as the vulnerability manifests as memory access rather than process crashes or network signals. Endpoint Detection & Response (EDR) tools may flag suspicious memory access patterns or renderer process anomalies if combined with other post-compromise indicators. Focus detection efforts on identifying renderer process compromises (malware execution, suspicious library injection) rather than this vulnerability in isolation.

Why prioritize this

Although Chromium classified this as Low severity and it requires renderer compromise as a prerequisite, the CVSS 6.5 MEDIUM score reflects real confidentiality risk. Prioritize patching for high-value targets, systems handling sensitive data, and endpoints in malware-prone environments. Organizations in targeted sectors or with active malware incidents should patch urgently. Standard enterprise endpoints without heightened risk can follow the next regular update cycle, provided no active exploitation is observed.

Risk score, explained

The CVSS 3.1 score of 6.5 is driven by: (1) Network accessible attack vector (AV:N), (2) Low attack complexity once renderer is compromised (AC:L), (3) No privileges required from the attacker (PR:N), (4) User interaction needed to visit the malicious page (UI:R), (5) High confidentiality impact from memory disclosure (C:H), and (6) No integrity or availability impact (I:N/A:N). The score appropriately reflects that while entry is gated by renderer compromise, the information disclosure risk is substantial once that condition is met.

Frequently asked questions