CVE-2026-14053: Google Chrome Extension Policy Bypass – Cross-Origin Data Leakage

Technical summary

CVE-2026-14053 is an origin-bypass vulnerability in Chrome's extension sandbox enforcement mechanism. The vulnerability exists in Google Chrome versions prior to 150.0.7871.47. An attacker with prior control of the renderer process could craft a malicious HTML page that, when loaded by a victim, would trigger insufficient policy checks in the extension subsystem, resulting in cross-origin data disclosure. The issue is classified CWE-346 (Origin Validation Error) and assigned CVSS 4.3 MEDIUM severity. Chromium's internal assessment rated this as Low severity, reflecting the high bar for initial compromise required to weaponize the flaw.

Business impact

This vulnerability poses a targeted risk rather than a mass-exploitation threat. Organizations where users visit untrusted websites on Chrome instances that have already been compromised by malware face potential data leakage from extension-mediated APIs or stored credentials. For most enterprises with application-focused Chrome deployments or managed endpoint security, the practical risk is limited to scenarios involving advanced persistent threat (APT) activity or insider threats. However, organizations handling sensitive data in browser extensions or relying on extension-based authentication should treat this as part of a defense-in-depth review.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. Desktop and mobile variants of Chrome running affected versions present equivalent risk. Users of other Chromium-based browsers should check their vendors' patch schedules and version alignment with the upstream Chromium fix.

Exploitability

Exploitation requires two sequential conditions: (1) the attacker must have already compromised the Chrome renderer process through a separate vulnerability or malware infection, and (2) the victim must then visit a crafted webpage while that compromised renderer is active. This two-stage requirement significantly limits real-world exploitability. The vulnerability does not grant arbitrary code execution; it enables data exfiltration only from cross-origin contexts that the compromised renderer can access. There is no evidence of active exploitation or availability of public proof-of-concept code as of the publication date.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For organizations with managed Chrome deployments, issue a mandatory update policy immediately. Verify patch deployment through Chrome's internal update status or by reviewing the version string in chrome://settings/help. Users on non-managed installations should enable automatic updates to receive the patch transparently. Supplementary measures include regular malware scanning to reduce the likelihood of renderer-process compromise and security awareness training regarding the risks of visiting untrusted sites.

Patch guidance

Google has released the fix in Chrome 150.0.7871.47. Enterprise administrators should deploy this version through standard Chrome update mechanisms (managed via Active Directory Group Policy on Windows, MDM on mobile, or manual updates on unmanaged systems). Verify in your deployment logs that endpoints report version 150.0.7871.47 or higher. No interim workarounds exist; update is the sole mitigation path. For organizations on extended support schedules, confirm your vendor's update timeline and expedite if possible given the cross-origin data exposure risk.

Detection guidance

Detection of active exploitation is limited by the vulnerability's design: the attacker must have already compromised the renderer process, and the malicious page load is difficult to distinguish from legitimate traffic. Behavioral indicators include: (1) unexpected network requests from Chrome to unusual external IPs following intensive page-load activity; (2) unusual patterns of extension API calls captured in audit logs if your environment logs extension behavior; (3) evidence of prior renderer-process compromise via process memory inspection or EDR telemetry. Standard endpoint detection and response (EDR) platforms may flag the initial renderer compromise but not the subsequent cross-origin leak itself. Focus detection efforts on identifying and isolating the root compromise rather than the secondary data exfiltration.

Why prioritize this

While the CVSS score of 4.3 MEDIUM reflects the moderate severity, prioritization should be based on your environment's risk tolerance for data loss. Organizations with sensitive extension-mediated workflows, browser-stored credentials, or employees who frequently visit untrusted sites should prioritize this patch in the 0–30 day window. For general enterprises with well-segmented networks and robust endpoint security, standard patch cadence (within 60 days) is acceptable. The key differentiator is the presence of a prior renderer compromise; without it, exploitation is not feasible.

Risk score, explained

The CVSS 4.3 MEDIUM score reflects: (1) network-based attack vector (AV:N) enabling remote exploitation; (2) low attack complexity (AC:L) once the renderer is compromised; (3) no privileges required (PR:N); (4) user interaction required (UI:R) to visit the malicious page; (5) limited scope (S:U); and (6) confidentiality impact only (C:L), with no integrity or availability impact. This score accurately captures the leakage of sensitive data across origin boundaries. The discrepancy with Chromium's internal Low rating reflects Chromium's assessment that the prerequisite renderer compromise is sufficiently rare to warrant a lower internal score; the CVSS rating is more conservative and defensive.

Frequently asked questions