CVE-2026-14058: Chrome Content Security Policy Bypass Before 150.0.7871.47

Technical summary

The vulnerability stems from insufficient validation during HTML parsing in Chrome's parser component. The flaw allows crafted HTML content to evade Content Security Policy enforcement, which is a critical browser security mechanism designed to restrict script execution, stylesheet loading, and other resource handling. The attack vector is network-based with low complexity; the vector notation (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates no authentication required, but user interaction is necessary. The impact is limited to integrity violations—attackers cannot exfiltrate data or achieve confidentiality breaches through this flaw alone, and availability is unaffected.

Business impact

While this vulnerability enables CSP bypass attacks, the practical business risk depends on your organization's reliance on CSP as a defense layer. For enterprises that depend on CSP to prevent malicious script injection in user-facing applications or email systems, this could allow attackers to execute scripts that CSP would normally block. The threat is elevated if your users visit untrusted websites or if your own web properties are targeted with injected malicious HTML. However, the Medium severity and requirement for user interaction means this is not an immediate critical business threat; it is a defense-in-depth concern rather than a direct pathway to system compromise.

Affected systems

Google Chrome browsers running versions prior to 150.0.7871.47 are affected. This includes Windows, macOS, Linux, Android, and iOS installations. Organizations should verify the current Chrome version across their user base—both managed corporate deployments and personal devices used for work—to determine exposure scope. The vulnerability does not affect other Chromium-based browsers (Edge, Brave, etc.) unless they have independently backported the vulnerable code; check vendor advisories for those products separately.

Exploitability

Exploitation requires a remote attacker to craft malicious HTML and trick a user into visiting it. There is no worm-like propagation, no network-based exploitation without user interaction, and no ability to exploit via email attachment alone without user action (e.g., opening in a browser). The barrier to exploitation is moderate: attackers need to host a malicious page or inject it into a compromised website, but they cannot remotely exploit unvisited browsers. Once a user lands on the page, the CSP bypass is largely automatic. The Chromium team assigned this a Low severity rating, reflecting that CSP is a secondary defense rather than the primary security boundary.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism typically deploys patches within days, but administrators managing enterprise Chrome deployments should verify rollout status in their management console. Users should check Chrome menu > About Google Chrome to confirm installation of the patch; the browser will auto-restart if an update is pending. No configuration changes or workarounds are available prior to patching.

Patch guidance

Administrators should validate that Chrome version 150.0.7871.47 or later is deployed across their organization. For managed deployments via Google Admin Console or MDM tools, confirm the update policy is set to auto-update on standard schedules. For unmanaged consumer users, remind them to allow Chrome to auto-update or manually check for updates. Verify patch status by checking Chrome's About page, which will display the current version. Consider prioritizing patches for endpoints where users frequently visit untrusted third-party websites or where CSP is relied upon for security boundaries.

Detection guidance

Monitor Chrome version inventory via endpoint detection and response (EDR) tools, asset management systems, or device compliance scanners. Most organizations lack direct visibility into CSP bypass attempts unless they instrument their web applications with Content Security Policy violation reports (CSP report-uri or report-to directives). For networks hosting web properties, enable CSP reporting to detect and log violations—though attackers exploiting this flaw may evade those reports themselves. Host-based detection is limited; focus on version compliance rather than behavioral detection.

Why prioritize this

This vulnerability carries a Medium CVSS score and requires user interaction, placing it below critical or high-severity flaws in remediation priority. However, it should not be ignored: CSP is a valued defense mechanism for web-facing applications, and organizations that rely on CSP as a primary control should prioritize this patch over less impactful updates. Additionally, if your user base includes security researchers, developers, or others who regularly visit untrusted code repositories or security blogs, exploitation risk increases. Patch within your standard 30–60 day window, or accelerate if your organization hosts user-facing web applications or relies heavily on CSP for content filtering.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible vulnerability with no authentication requirement but mandatory user interaction, low attack complexity, and limited impact scope. The integrity impact (I:L) is the primary concern—attackers can cause scripts or content to execute where CSP would normally prevent it. Confidentiality and availability are unaffected. The score appropriately downgrades severity because CSP is a secondary defense; modern browsers employ multiple mitigations (same-origin policy, sandbox isolation, etc.) that reduce the real-world impact of CSP bypass. Chromium's own Low severity assessment aligns with this calibration.

Frequently asked questions