CVE-2026-14052: Chrome FileSystem Access Control Bypass (Version <150.0.7871.47)

Technical summary

CVE-2026-14052 is an insufficient policy enforcement vulnerability in Chrome's FileSystem implementation. The flaw resides in discretionary access control (DAC) mechanisms—specifically the browser's ability to enforce user-level file access restrictions. By sending a crafted HTML page to a victim, a remote attacker can bypass these DAC protections, potentially enabling unintended file system interactions. The vulnerability requires user interaction (visiting a malicious page) but does not require authentication or special browser configuration. The root cause stems from CWE-284: improper access control validation in a security-relevant context.

Business impact

For most users, the practical risk is limited since exploitation requires both a successful social engineering attack and a user's active browser session. However, organizations with sensitive data stored locally or strict compliance requirements around file integrity should treat this seriously. The vulnerability affects confidentiality minimally (CVSS shows no confidentiality impact), but integrity is directly compromised—unauthorized file modifications are possible. In regulated environments (healthcare, finance, legal), even low-scoring integrity violations can trigger incident response workflows and audit documentation.

Affected systems

All Google Chrome browsers prior to version 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, and ChromeOS. Organizations using Chrome as a managed browser or relying on Chrome-based Chromium derivatives should verify their versions and patch timelines. Users on older release channels (Extended Stable, for example) may lag behind the rapid patch cycle and require additional attention.

Exploitability

Exploitability is moderate in practical terms. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms that the attack is network-based, requires no privileges, and has low complexity—but crucially, user interaction is required. An attacker must convince a user to visit a malicious page. There is no evidence of active exploitation in the wild (KEV status is false), and Chromium's severity rating was 'Low,' suggesting the Chrome security team did not assess this as an immediate threat vector. However, the barrier to exploitation is not prohibitively high; a convincing phishing email or watering hole attack could be sufficient.

Remediation

Users should update Chrome to version 150.0.7871.47 or later immediately. Organizations should verify update deployment through mobile device management (MDM) or endpoint management platforms. For enterprises managing Chrome through Group Policy or similar mechanisms, ensure auto-update is enabled or schedule manual updates. Test the update in a non-production environment first if your organization has strict change control processes, though the risk of regression is minimal for a security patch.

Patch guidance

Update Chrome to version 150.0.7871.47 or later. Verify the update through Chrome's Settings > About Chrome, which will trigger an automatic version check. For managed deployments, use your organization's Chrome administration console or policy templates to push the update. Monitor deployment success through your endpoint management tools. The patch was released on or shortly after June 30, 2026 (the published date of this CVE); verify the exact release date through the official Chrome release notes to ensure your chosen version includes the fix.

Detection guidance

Monitor for Chrome process version drift in your environment using endpoint detection and response (EDR) tools or mobile device management platforms. Look for processes running Chrome versions prior to 150.0.7871.47. Network-based detection is difficult since the attack relies on malicious HTML content delivered via normal HTTPS traffic; however, you may monitor for suspicious file system access patterns on endpoints if your EDR solution provides file system activity auditing. Consider cross-referencing browser logs with file system audit logs on sensitive data stores to identify unauthorized access attempts.

Why prioritize this

While the CVSS score of 4.3 places this in the medium severity range, the practical urgency is moderate. The vulnerability requires user interaction and does not result in confidentiality breaches, remote code execution, or availability impact. However, prioritize patching over non-critical updates because the integrity impact is direct and the exploit path is straightforward once a user visits a malicious page. Organizations in highly regulated sectors should prioritize this higher; those with general-purpose Chrome deployments can include it in the next scheduled patch window (typically within 1–2 weeks).

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a medium severity rating driven by the integrity impact (I:L) and the network attack vector with low complexity. The score is suppressed by the lack of confidentiality impact, no availability impact, and the requirement for user interaction. The 'Scope Unchanged' (S:U) rating means the vulnerability does not escape the security scope of the vulnerable component (it affects only file access within Chrome's context). This score is appropriate for a bug that requires convincing a user to visit a malicious page but does result in real file system access violations.

Frequently asked questions