CVE-2026-14069: Chrome WebNN Integer Overflow Information Disclosure

Technical summary

CVE-2026-14069 is an integer overflow vulnerability in Chrome's WebNN implementation that enables information disclosure. The flaw occurs when WebNN processes crafted input, causing integer arithmetic to wrap unexpectedly and leak adjacent memory regions to an attacker-controlled script. The vulnerability is triggered during HTML page rendering when WebNN APIs are invoked with specially constructed parameters. While Chromium's security team classified this as Low severity, the CVSS 3.1 score of 6.5 reflects the combination of network exploitability and high confidentiality impact, tempered by the requirement for user interaction and the absence of integrity or availability impact.

Business impact

This vulnerability enables attackers to exfiltrate sensitive data—such as cached credentials, authentication tokens, personal information, or data from other tabs—by compromising the memory isolation that browsers normally enforce. For organizations where employees access sensitive cloud platforms or handle confidential data in Chrome, this represents a real risk of credential theft or data leakage. The attack surface is broad since it requires only that a user visit a malicious or compromised website. However, the impact is limited to confidentiality; legitimate application functionality and system availability are unaffected.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. The vulnerability is browser-specific and affects users on Windows, macOS, and Linux platforms. The listing of Windows, macOS, and Linux kernel as affected vendors reflects the operating system distribution of vulnerable Chrome installations; the underlying flaw resides in Chrome itself. Chrome users on any of these platforms running versions 150.0.7871.46 or earlier face exposure.

Exploitability

Exploitation is straightforward from an attacker perspective. No privilege escalation is required, and the attack can be delivered remotely via a crafted HTML page hosted on the internet or injected into a legitimate website. However, the user must actively visit or be tricked into visiting the malicious page. There is no evidence of in-the-wild exploitation, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, suggesting it remains largely theoretical at the time of disclosure. An attacker would need basic web development skills to construct the payload.

Remediation

The primary remediation is to update Google Chrome to version 150.0.7871.47 or later. Users should enable automatic updates in Chrome settings to receive the patch promptly. Organizations should verify successful deployment of the patched version across their fleet and consider temporary compensating controls, such as blocking known malicious sites or using browser isolation technologies, for users who cannot update immediately. No workaround prevents exploitation without patching.

Patch guidance

Google Chrome will auto-update on supported systems. To manually verify the patched version, users should navigate to Chrome menu > Help > About Google Chrome, which will display the current version and automatically update if a newer version is available. Organizations using Chrome Enterprise should deploy Chrome version 150.0.7871.47 or later through their standard update management process. Verify patch application within 24–48 hours of release and confirm version numbers in your device inventory tools.

Detection guidance

Monitor Chrome version numbers across your environment using endpoint management tools or browser telemetry. Organizations with web traffic inspection capabilities should look for unusual memory access patterns in WebNN API calls, though this requires deep packet inspection or WebNN-specific monitoring. From a host perspective, check installed Chrome version numbers. Network-based detection is difficult without WebNN-specific signatures; vendor IDS/IPS rules may be available from Chromium security advisories. Behavioral detection of post-exploitation data exfiltration (unusual outbound connections with sensitive data patterns) may indicate compromise.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS 6.5 Medium score reflects realistic exploitability via a web-based attack vector, but the requirement for user interaction and the absence of active exploitation lower operational urgency compared to critical remote code execution flaws. However, organizations handling highly sensitive data in Chrome (finance, healthcare, government) or those with high-risk user populations should prioritize patching within 1–2 weeks. For general enterprise environments, standard patch cycles (monthly) are acceptable unless the user population is particularly exposed to malicious web content.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is driven by: (1) Network Attack Vector (AV:N), meaning the flaw is exploitable over the internet without any network proximity requirement; (2) Low Attack Complexity (AC:L), since no special conditions or race conditions are required; (3) No Privileges Required (PR:N); (4) Required User Interaction (UI:R), lowering the score because a victim must visit a malicious page; (5) High Confidentiality Impact (C:H), reflecting the ability to read arbitrary process memory; and (6) No Integrity or Availability Impact (I:N, A:N). The user interaction requirement prevents this from a 7.5 or higher score, and the memory disclosure limitation keeps it from a critical rating.

Frequently asked questions