CVE-2026-14065: Chrome Navigation Bypass via PageInfo Validation Flaw

Technical summary

The vulnerability stems from insufficient validation of untrusted input within Chrome's PageInfo component, which handles navigation security policies and access controls. An attacker with a compromised renderer process can supply crafted HTML that bypasses navigation restrictions—controls typically enforced to prevent users from being directed to dangerous or restricted sites. The flaw is classified under CWE-20 (Improper Input Validation), indicating that PageInfo does not adequately sanitize or validate input before applying it to navigation decisions. The attack vector is network-based with low attack complexity, but requires user interaction and assumes the renderer process is already compromised, limiting the initial attack surface.

Business impact

For organizations relying on Chrome's navigation safeguards—particularly those enforcing URL filtering, restricted site policies, or preventing access to blocked destinations—this vulnerability creates a bypass channel. If a renderer process is compromised (through a separate exploit or malware injection), an attacker can then steer users to unintended locations, potentially violating compliance controls or exposing users to secondary attacks. The impact is primarily on integrity rather than confidentiality or availability, making it a medium-severity concern rather than critical. Organizations with tight browser policy controls should evaluate whether this affects their threat model.

Affected systems

The vulnerability affects Google Chrome prior to version 150.0.7871.47 across Windows, macOS, and Linux platforms. The advisory lists Chrome, macOS, the Linux kernel, and Windows as affected vendors/products—though the core vulnerability is specific to Chrome itself; the platform listing reflects that Chrome runs on all these operating systems. Any user or system running an unpatched version of Chrome before 150.0.7871.47 is technically exposed, though exploitation requires that the renderer process has already been compromised by another attack.

Exploitability

Exploitability is constrained by prerequisites. While the network attack vector and low attack complexity suggest ease of delivery, the vulnerability requires the renderer process to be compromised beforehand. This means an attacker must first deploy separate malware, exploit, or social engineering to compromise Chrome's renderer before leveraging this PageInfo bypass. No public evidence suggests this is being actively exploited in the wild, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. The practical attack chain is non-trivial, reducing immediate risk for most organizations unless they face sophisticated, multi-stage threats.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update mechanism typically deploys patches within hours to days for all supported platforms. For macOS and Linux users, check for updates via the browser menu (Help > About Google Chrome on most platforms). Windows users can enable automatic updates in Chrome settings. Organizations managing Chrome fleet-wide should use Google's official patch deployment tools and verify rollout before considering the issue resolved.

Patch guidance

Verify that your Chrome version is 150.0.7871.47 or later by navigating to Help > About Google Chrome (or the equivalent menu on your platform). The browser will display the current version and automatically check for updates. If a newer version is available, allow the update to complete and restart the browser. For managed environments, administrators should deploy this patch via Chrome policy (via Google Admin Console for G Suite domains, or via local group policy on Windows) to ensure all instances are updated promptly. No manual workarounds or configuration changes mitigate the vulnerability short of patching.

Detection guidance

Detection of exploitation attempts is challenging because the vulnerability requires prior renderer compromise. Network-based detection of the crafted HTML payloads themselves is difficult without behavioral analysis. Monitor for: (1) unexpected navigation events to unusual or restricted destinations after Chrome crashes or restarts (suggesting renderer recovery post-compromise), (2) process crashes or anomalies in the Chrome renderer process (gpu-process, renderer processes), and (3) signs of renderer-process-targeting malware (e.g., code injection, suspicious DLL loads on Windows). Behavioral analytics on endpoint detection and response (EDR) tools may flag abnormal navigation patterns. Most organizations should prioritize patching over detection-focused responses given the moderate severity and prerequisite compromise requirement.

Why prioritize this

While CVE-2026-14065 carries a CVSS score of 6.5 (Medium), it should not be treated as critical priority. The attack requires pre-existing renderer process compromise, limiting its value as a standalone initial-access vector. However, it is worth timely patching because: (1) it represents a known defense evasion technique for an already-compromised system, (2) Chrome's large user base means even low-risk vulnerabilities can accumulate organizational risk, and (3) routine patching is low-friction for Chrome. Deprioritize in favor of critical/high-severity vulnerabilities (CVSS 9+) or zero-days with active exploitation. Schedule this update in your standard patch cycle (weekly or bi-weekly) rather than emergency response protocols.

Risk score, explained

The CVSS 6.5 score reflects: Network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R). The score emphasizes integrity impact (I:H) with no confidentiality or availability impact (C:N, A:N). While the vector string appears to indicate a broadly accessible attack, the real-world context—that renderer compromise is prerequisite—significantly reduces the practical risk. CVSS does not account for this prerequisite, making the numerical score higher than the true exploitability risk. Organizations should weigh the score against the actual attack chain requirements.

Frequently asked questions