CVE-2026-14059: Chrome Related-Website-Sets Cross-Origin Data Leak (CVSS 6.5)

Technical summary

CVE-2026-14059 stems from insufficient policy enforcement in the Related-Website-Sets (RWS) mechanism within Google Chrome. Related-Website-Sets is a privacy feature designed to allow related domains (e.g., example.com and example.co.uk) to declare associations and manage cookies in a controlled manner. The flaw enables an attacker to bypass the intended policy constraints through a crafted HTML page, allowing unauthorized access to cross-origin data. The vulnerability is classified under CWE-693 (Protection Mechanism Failure), indicating that a security control meant to isolate cross-origin resources has been circumvented. Exploitation requires network access and user interaction but does not require elevated privileges.

Business impact

Organizations and individual users relying on browser isolation to protect sensitive data across multiple sites face elevated risk. If employees visit a malicious site while logged into corporate web applications, account data or session tokens could be leaked to the attacker. For enterprises managing single sign-on (SSO) systems or relying on cookies for authentication across federated domains, this vulnerability could facilitate credential theft or unauthorized API access. Financial services, healthcare, and SaaS platforms with cross-domain authentication schemes are particularly exposed. The requirement for user interaction limits mass exploitation but does not eliminate the risk in targeted or social engineering campaigns.

Affected systems

Google Chrome browser prior to version 150.0.7871.47 is the primary vector. Because Chrome runs on Windows, macOS, and Linux, all three platforms are affected. While the CVE references Linux kernel and OS-level products in its metadata, the vulnerability itself is specific to the Chrome browser. Organizations running any version of Chrome before 150.0.7871.47 on any supported operating system should treat this as actionable risk.

Exploitability

Exploitation is moderately straightforward: an attacker crafts a malicious HTML page designed to trigger the Related-Website-Sets policy bypass and hosts it on a web server or distributes it via phishing. When a victim visits the page, no special browser settings or user actions beyond normal browsing are required beyond visiting the site. The attack does not require zero-click mechanisms or drive-by downloads. However, the attacker must predict or know which cross-origin sites the victim is logged into to make the attack valuable. The vulnerability has not been assigned a KEV (Known Exploited Vulnerability) listing, indicating no evidence of active in-the-wild exploitation at the time of this analysis, though this does not guarantee future exploitation will not occur.

Remediation

Users and administrators must update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update mechanism will push this patch, but verification is recommended for environments with delayed auto-update policies. There is no workaround that restores full security without upgrading. Organizations can reduce exposure risk by enforcing browser policies that restrict access to high-risk domains and by educating users to avoid clicking suspicious links, particularly on corporate networks. Implementing Content Security Policy (CSP) headers on internal applications and requiring multi-factor authentication for sensitive operations can also mitigate the impact of successful cross-origin data leaks.

Patch guidance

Update to Chrome version 150.0.7871.47 or later as soon as is operationally feasible. For enterprise deployments using managed Chrome instances, push the update via your organization's software distribution tools. Verify the update by navigating to chrome://version and confirming the version number reflects 150.0.7871.47 or higher. If using Chromium-based browsers (Edge, Brave, etc.), check with the respective vendor for their patched release timeline, as they may lag behind Chrome. No rollback is recommended; the patch carries no known breaking changes for standard web functionality.

Detection guidance

Monitor Chrome update deployment to ensure endpoints have applied the patch. Check chrome://extensions and chrome://version via Group Policy or mobile device management (MDM) tools for confirmation. Network-based detection is difficult, as the attack manifests as normal HTTPS traffic to the malicious site. Behavioral monitoring for unusual cross-site data requests or session token access patterns is impractical at scale. Focus on endpoint patch management and user reporting of suspicious websites. If you suspect compromise, inspect browser cookies and session storage for unexpected entries and audit user account activity logs on cross-origin services (email, cloud platforms, internal systems) for unauthorized access.

Why prioritize this

Although Chromium's internal severity rating is low, the CVSS 3.1 score of 6.5 (MEDIUM) reflects the real-world risk: high potential impact (confidentiality breach of cross-origin data), low attack complexity, no privilege requirement, and the need only for user interaction. For organizations where users authenticate to multiple sensitive services via the browser, cross-origin data leakage can unlock account takeover or lateral movement. The absence of KEV status suggests the window for patching is open before adversaries widely adopt this technique. Prioritize patching within a standard two-week cycle for critical systems, with a 30-day target for general employee devices.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: AV:N (network-exploitable), AC:L (low attack complexity—no special conditions), PR:N (no privileges required), UI:R (requires user interaction), S:U (scope unchanged), C:H (confidentiality impact high), I:N (integrity not directly impacted), A:N (availability not impacted). The high confidentiality impact and low barrier to exploitation justify a MEDIUM severity rating rather than low, despite the Chromium project's internal assessment. Real-world impact depends on whether victims are logged into valuable cross-origin services at the moment of exploitation.

Frequently asked questions