CVE-2026-14061: Chrome Dawn Memory Disclosure Vulnerability – Patch Now

Technical summary

CVE-2026-14061 is an information disclosure vulnerability in Chrome's Dawn graphics implementation (which handles WebGPU operations). The flaw stems from inappropriate implementation that fails to properly isolate process memory from untrusted graphics operations. An attacker-controlled HTML page can exploit insufficient bounds checking or memory access controls in Dawn to read adjacent memory regions. The vulnerability is network-accessible, requires no special privileges, and depends only on user interaction to view a malicious webpage. Chromium rated the underlying issue as Low severity, though the CVSS 3.1 score of 6.5 (MEDIUM) reflects the confidentiality impact and ease of exploitation via a remote webpage.

Business impact

This vulnerability poses a data confidentiality risk to any organization whose employees browse the internet using affected Chrome versions. Attackers could harvest session tokens, API keys, cached credentials, or other sensitive data from user browser memory, potentially leading to account compromise or lateral movement within enterprise networks. The requirement for user interaction makes this a social engineering vector—phishing campaigns could combine malicious links with legitimate-seeming content to maximize exploitation. Organizations with strict browser policies or security-conscious user bases face lower immediate risk, but the six-month window before the patch (from June to assumed December patching cycles) creates an exposure window.

Affected systems

All versions of Google Chrome prior to 150.0.7871.47 are vulnerable, regardless of operating system. Affected platforms include Windows, macOS, and Linux systems running vulnerable Chrome builds. Any derivative or embedded Chromium-based browser (Edge, Opera, Brave, etc.) using the same Dawn codebase may also be vulnerable; verify with individual vendors. Enterprise deployments of Chrome on corporate desktops, laptops, and cloud-based browser services are all in scope.

Exploitability

Exploitation is straightforward but not automated. An attacker must craft an HTML page that triggers the Dawn memory access flaw, then distribute it via phishing, malicious ads, or compromised websites. The attack requires no user credentials and works against patched systems only through the user's willingness to visit the attacker's site. Detection by security-aware users is difficult because the payload executes silently within the graphics pipeline. Mitigation is not possible through browser configuration alone—only patching to version 150.0.7871.47 or later eliminates the vulnerability.

Remediation

Google released the patch in Chrome 150.0.7871.47. Users and administrators must update Chrome immediately to the patched version or newer. For enterprises, this should be deployed through managed Chrome updates (Windows domain policy, macOS profiles, or Chrome Enterprise policies). Organizations unable to update immediately should restrict browsing to trusted internal sites and monitor for suspicious memory access patterns or unusual data exfiltration. Consider requiring VPN or proxy inspection to detect exploitation attempts, though these measures are not foolproof against in-browser attacks.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later. Enterprise administrators should use Chrome Enterprise policies to enforce automatic updates and prevent users from disabling auto-update. For Windows, use Group Policy or Windows Update for Business to manage Chrome updates. For macOS, use Mobile Device Management (MDM) or Mac preferences via .plist files. For Linux, update via your distribution's package manager or use the official Chrome repository. Verify in chrome://settings/help that the browser is running version 150.0.7871.47 or higher after patching. Note that all Chromium derivatives (Edge, Brave, Opera, etc.) must be updated separately from their respective vendor release channels.

Detection guidance

Detection of exploitation is challenging without instrumentation at the kernel or hypervisor level, as the attack exploits graphics memory handling. Monitor for: (1) Unusual network traffic or DNS queries immediately following user visits to untrusted sites; (2) Unexpected credential usage or lateral movement after users browsed the internet; (3) Anomalous data exfiltration from endpoints running unpatched Chrome. Endpoint Detection and Response (EDR) tools should flag unexpected child processes spawned from Chrome or unusual memory access patterns if configured with graphics-focused rules. Network security tools cannot reliably block this attack in transit, so prevention through patching is essential.

Why prioritize this

Although Chromium assigned Low severity and the vulnerability requires user interaction, the CVSS score of 6.5 (MEDIUM) and high confidentiality impact warrant prompt patching. The six-month disclosure-to-patch window before typical enterprise update cycles suggests this is a medium-priority remediation. If your organization has a high-value workforce or executive targets, phishing risk is elevated. If employees browse untrusted sites frequently (customer support, research roles), prioritize patching within 30 days. For low-risk environments (government, critical infrastructure with controlled browsing), patching within 60-90 days is acceptable but not advisable given the straightforward exploitation model.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network attack vector (AV:N) and low complexity (AC:L) make exploitation easy and remote; (2) No privilege requirement (PR:N) means any website can attempt the attack; (3) User interaction required (UI:R) moderately limits scope; (4) High confidentiality impact (C:H) because process memory can leak sensitive data; (5) No integrity or availability impact (I:N/A:N) because the attack is read-only. The Chromium Low severity assessment may underestimate real-world risk given that stolen credentials enable further attacks; thus the independent CVSS score of MEDIUM is justified for prioritization purposes.

Frequently asked questions