CVE-2026-14062: Chrome/ChromeOS Memory Disclosure via Malicious Extension – CVSS 5.9

Technical summary

CVE-2026-14062 is an information disclosure vulnerability in Chrome's Views subsystem affecting ChromeOS versions before 150.0.7871.47. The vulnerability stems from inappropriate implementation that fails to properly isolate process memory from untrusted extension code. An attacker can craft a malicious Chrome Extension that, once installed by a victim, reads sensitive data directly from Chrome process memory. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and carries a CVSS 3.1 score of 5.9 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network-based attack vector, high attack complexity, and confidentiality impact.

Business impact

Data breach risk is the primary business impact. If an attacker successfully deploys a malicious extension, they could exfiltrate sensitive information stored in Chrome's memory—this may include authentication tokens, cached user data, or other confidential information processed during browser sessions. The attack surface is limited by the user interaction requirement (extension installation), which reduces the likelihood of large-scale automated compromise. However, targeted attacks against high-value individuals (executives, engineers, researchers) using social engineering could yield significant data theft. Organizations relying on ChromeOS for security-sensitive work should assess whether users handle sensitive data where memory exposure poses compliance or operational risk.

Affected systems

The vulnerability affects Google Chrome and ChromeOS running versions prior to 150.0.7871.47. This includes consumer editions of Chrome and all ChromeOS devices (Chromebooks and Chrome Enterprise devices) below the patched version. Organizations using older device models with locked software versions should verify upgrade feasibility with their IT and device management teams.

Exploitability

The CVSS vector reflects high attack complexity (AC:H), meaning successful exploitation is not trivial. Exploitation requires two sequential user actions: first, convincing a user to install a malicious extension from an untrusted source, and second, the extension must be crafted with specific knowledge of Chrome's memory layout and access patterns. While not a one-click exploit, determined attackers targeting specific individuals (spear-phishing with trojanized extensions) or through supply-chain compromise of legitimate-looking extensions represent realistic threat scenarios. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no documented active exploitation in the wild at time of publication.

Remediation

Update Chrome and ChromeOS to version 150.0.7871.47 or later. For consumer users, Chrome typically auto-updates; verify the version in Settings > About Chrome. For ChromeOS devices, ensure automatic updates are enabled and reboot if prompted. Organizations should enforce update policies to exclude extensions from untrusted sources and consider restricting extension installation through enterprise policies. Educate users to install extensions only from the official Chrome Web Store and review extension permissions before installation.

Patch guidance

Patch version 150.0.7871.47 or later remedies this vulnerability. For ChromeOS users: updates are generally automatic, but you can manually check via Settings > About Chrome OS and allow the update to download and install. For Chrome on other platforms running ChromeOS: verify auto-update is enabled and force a check via Settings > About Chrome. Enterprise environments using Chromebook deployments should verify patch deployment through their Mobile Device Management (MDM) or Google Admin Console. Audit any currently installed extensions and remove any that lack clear business justification or originate from untrusted developers.

Detection guidance

Direct detection of exploitation is limited because the attack is memory-based and leaves minimal on-disk forensic traces. However, organizations can implement the following: (1) Monitor extension installation logs in Chrome or MDM systems for unexpected or suspicious extension additions, particularly from sources outside the official Chrome Web Store. (2) Track process memory access patterns if you have endpoint detection and response (EDR) tools that hook syscalls related to memory inspection. (3) Review browser history and network logs for unusual data exfiltration patterns following extension installation. (4) Implement extension allowlist policies to prevent unauthorized extensions from running. Note: If compromise is suspected, assume data in Chrome memory at the time of extension installation may have been accessible; review logs for what user was doing during that window.

Why prioritize this

While the CVSS score of 5.9 places this in the Medium range, the practical risk depends on your organization's threat model. Prioritize patching if: (1) your users are high-value targets (C-level, engineering, legal teams handling sensitive data), (2) you operate in regulated industries where data exposure incurs compliance liability, or (3) your organization has experienced prior targeted spear-phishing campaigns. Lower-priority if your environment has strong extension governance policies and user training already in place. The attack's reliance on user action to install a malicious extension significantly reduces the blast radius compared to remote code execution vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 5.9 (Medium) reflects: (a) confidentiality impact rated as HIGH because uncontrolled process memory access could expose sensitive data, (b) no integrity or availability impact because the attack is passive—memory is read but not modified and service is not disrupted, (c) high attack complexity due to the need for extension installation and social engineering, and (d) user interaction required (UI:N in the vector means no direct user action during exploitation, but practically the user must install the malicious extension first). The score appropriately penalizes the attack for needing user deception but acknowledges that successful compromise has serious confidentiality consequences.

Frequently asked questions