CVE-2026-14057: Chrome FedCM Same-Origin Policy Bypass – Patch and Remediation Guide

Technical summary

CVE-2026-14057 is an origin-policy bypass flaw in Chrome's FedCM component, a credential-handling subsystem designed for federated identity workflows. The root cause is inappropriate implementation logic that fails to properly enforce same-origin restrictions when processing federated credential requests. By crafting a malicious HTML payload and inducing a user to visit the page, an attacker can circumvent the browser's origin-checking mechanisms, allowing credential leakage or impersonation scenarios. The issue is classified as CWE-346 (Origin Validation Error) and carries a CVSS 3.1 score of 4.3 (Medium severity), reflecting moderate impact with low attack complexity but requiring user interaction.

Business impact

This vulnerability poses a targeted identity and authentication risk. Organizations relying on federated login workflows (OAuth, SAML, or similar patterns via FedCM) may face credential compromise or session hijacking if users are tricked into visiting attacker-controlled sites. The impact is contained by the requirement for active user participation, reducing the risk of large-scale automated exploitation. However, phishing campaigns targeting employees at federated-identity-heavy organizations could weaponize this flaw to obtain legitimate credentials without triggering secondary authentication factors.

Affected systems

Google Chrome browsers with versions prior to 150.0.7871.47 are affected. Chromium-based browsers that have not yet merged this patch (including Edge, Brave, Opera, and other Chromium derivatives) may also be vulnerable until they update. Desktop, mobile, and embedded deployments running unpatched versions of these browsers are in scope.

Exploitability

The attack requires network access and user interaction; it is not remotely exploitable without social engineering. The barrier to exploitation is moderate: an attacker must either trick a user into visiting a crafted URL or embed the payload in a compromised website. Once a user lands on the malicious page, the browser-level flaw is triggered automatically. No special attacker privileges are required. Chromium's internal assessment rated this as Low severity, suggesting limited real-world exploitation potential or narrow attack surface.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Users can verify their Chrome version by navigating to chrome://settings/help, which will also auto-download and install the latest version if available. For Chromium-based browsers (Edge, Brave, etc.), check for updates through their respective update mechanisms. Organizations with managed Chrome deployments should push the update via their device management platform to ensure timely coverage.

Patch guidance

Google has released Chrome 150.0.7871.47 to address this vulnerability. Apply the patch at your earliest convenience, prioritizing any systems or users handling federated identity workflows or high-value authentication scenarios. Most users will receive auto-updates within days; enterprises should verify deployment across their fleet. Test the update in a non-production environment first if your organization has critical web application dependencies on Chrome's FedCM behavior, though such dependencies are uncommon outside identity-provider ecosystems.

Detection guidance

Monitor for suspicious HTML pages served from unexpected origins or embedded in phishing emails, especially those that trigger federated login flows. Browser logs and security event data may show FedCM-related warnings or errors if exploitation is attempted. Implement email content filtering to detect phishing attempts that reference federated services. Network segmentation and user awareness training reduce the likelihood that users will click through to attacker-controlled pages. Endpoint detection tools should flag unusual credential-exchange behavior correlated with unpatched Chrome versions.

Why prioritize this

While the CVSS score is moderate, this vulnerability should be patched promptly because it undermines a core browser security boundary and targets authentication workflows. However, its reliance on user interaction and absence from the Known Exploited Vulnerabilities (KEV) catalog indicate it is not yet under active mass exploitation. Prioritize patching over emergency procedures, but do not delay beyond your standard update cadence. Organizations with high-value identity systems or frequent phishing attacks should move this to the front of the queue.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible vulnerability with low attack complexity but mandatory user interaction and limited direct impact (integrity only, no confidentiality or availability loss). The score appropriately captures the authentication-boundary breach, while the Medium rather than High rating acknowledges the interaction requirement and narrow attack surface. The absence of KEV status and Chromium's Low severity designation suggest this flaw is less likely to be weaponized at scale compared to, for example, a remote-code-execution issue.

Frequently asked questions