CVE-2026-14064: Use-After-Free in Chrome PageInfo on Android (CVSS 7.5)

Technical summary

CVE-2026-14064 is a use-after-free vulnerability (CWE-416) in the PageInfo component of Google Chrome for Android. The flaw occurs when the browser attempts to access memory that has already been freed, enabling code execution with the privileges of the Chrome process. The attack vector is network-based; the vulnerability is triggered when a user visits a malicious HTML page and performs targeted UI gestures (e.g., navigating through page info dialogs or performing specific touch interactions). The condition requires user interaction, raising the attack complexity. The vulnerability affects Chrome versions prior to 150.0.7871.47.

Business impact

Successful exploitation could allow attackers to execute arbitrary code on Android devices, potentially leading to unauthorized data access, credential theft, or device compromise. Given Android's role in enterprise environments (BYOD policies, corporate email, sensitive applications), this vulnerability poses a risk to organizational information security, especially if employees are targeted through spear-phishing with malicious URLs. The required user interaction limits but does not eliminate the risk, as social engineering remains effective.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. The vulnerability does not affect Chrome on desktop platforms (Windows, macOS, Linux) or Chrome on other mobile operating systems. Organizations deploying Android devices with Chrome as the primary or secondary browser should prioritize patching.

Exploitability

The vulnerability requires network access and user interaction; an attacker cannot silently exploit it. The specific UI gestures needed mean exploitation demands either precision social engineering or user error. No public exploit or active KEV listing exists as of the publication date, suggesting limited real-world exploitation to date. However, the defect is straightforward to fix and relatively discoverable, so weaponization is possible once patches are widely deployed and older versions are identifiable.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Users should enable automatic updates in the Google Play Store settings. Organizations managing Android devices via MDM/EMM solutions should push this update immediately. No workaround is available beyond updating; however, users may temporarily reduce risk by avoiding untrusted websites and being cautious with email links.

Patch guidance

Google has released Chrome 150.0.7871.47 as the patched version. Verify this version number in the official Chrome release notes and Google Play Store listing before deploying. For Android enterprise deployments, use your MDM platform to deploy the update to managed devices. Monitor Chrome version telemetry to confirm deployment success. Older versions should be blocked or removed from supported configurations.

Detection guidance

Monitor Chrome process crashes and restarts on Android devices, which may indicate exploitation attempts. In a controlled environment, test suspect URLs against the patched Chrome version to confirm they no longer trigger the vulnerability. Network detection is limited because the payload is delivered via HTTPS (encrypted). Focus detection efforts on anomalous device behavior post-visit to suspicious sites (new root access attempts, unusual app installations, data exfiltration). MDM/EMM solutions should report Chrome version compliance across your Android fleet.

Why prioritize this

Although Chromium rates this as 'Low' severity and it requires user interaction, the CVSS score of 7.5 reflects high integrity and confidentiality impact. Android users are frequent targets for phishing and social engineering. The vulnerability affects a widely used component (PageInfo) that many users interact with (e.g., viewing site certificates or permissions). Prioritize patching over the next 7–14 days, especially for high-risk users (finance, legal, executive staff) and BYOD populations.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: (1) network-based attack vector allowing remote delivery, (2) high impact on confidentiality, integrity, and availability (CWE-416 use-after-free can lead to code execution), and (3) user interaction requirement that increases complexity, reducing likelihood. The 'Low' Chromium severity reflects the component's relative isolation, but the practical impact of code execution justifies the elevated CVSS rating. Organizations should not underweight this based on the Chromium classification alone.

Frequently asked questions