CVE-2026-14070: Chrome WebNN Integer Overflow Memory Disclosure Vulnerability

Technical summary

CVE-2026-14070 is an integer overflow vulnerability (CWE-457) within Chrome's WebNN component that precedes version 150.0.7871.47. The flaw allows out-of-bounds memory access when processing specially crafted HTML, enabling information disclosure from process memory. The vulnerability requires user interaction (visiting a malicious page) and is reachable over the network without authentication. It does not enable code execution or denial of service, but the high confidentiality impact reflects the practical risk of leaking browser state, session tokens, or other sensitive data residing in memory.

Business impact

Information disclosure through memory leaks can compromise user privacy and organizational security. If victims include employees accessing internal systems, leaked session tokens or credentials from browser memory could facilitate lateral movement or account takeover. The attack surface is broad—any website visit triggers the risk—making this relevant to organizations concerned with employee browsing security. Data exfiltration may not be immediately visible, complicating breach detection and response.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The vulnerability is platform-independent, affecting Chrome on Windows, macOS, and Linux. While the CVE references the Linux kernel and specific operating systems in its metadata, the actual vulnerability resides in Chrome itself; the OS listing reflects Chrome's availability across those platforms rather than OS-specific code paths. All users on unpatched Chrome versions are at risk when visiting untrusted websites.

Exploitability

Exploitation requires a user to visit a crafted webpage—a modest barrier in a world of social engineering, watering holes, and ad-driven attacks. An attacker need not compromise a website; malicious ads or redirects can deliver the payload. No special user privileges are required; the vulnerability is accessible to unprivileged web content. However, actual data exfiltration depends on what sensitive information happens to be in memory at exploit time, which introduces some uncertainty for the attacker. The CVSS score of 6.5 (MEDIUM) reflects the combination of easy network access, user interaction requirement, and confidentiality impact without code execution.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This is a straightforward patch cycle. No workarounds are practical; users must either update or avoid untrusted websites. Organizations should prioritize patch deployment, particularly for roles that access sensitive systems or handle confidential data. Verify patch installation by checking Chrome's 'About Chrome' menu to confirm auto-update success.

Patch guidance

Patch immediately to Chrome 150.0.7871.47 or later. Chrome's auto-update mechanism typically rolls out patches within days; verify completion via Settings > About Chrome. For enterprise deployments using managed policies, validate update policies are not delaying rollout. Test patch application in your environment to confirm no extensions or custom configurations are blocking updates. No additional configuration is required post-patch; the WebNN component is automatically updated.

Detection guidance

Detection at the network level is difficult without specialized profiling; the malicious HTML is not inherently recognizable. Focus on Chrome version inventory to identify unpatched deployments. Monitor for suspicious browser behavior or user reports of unusual memory usage. Web access logs to suspicious domains or ad networks may provide indirect signal if a watering hole was involved. Host-based detection would require monitoring for abnormal WebNN API calls, which is technically challenging without deep browser instrumentation. Prioritize proactive patching over reactive detection.

Why prioritize this

Although Chromium's internal severity is Low and KEV status is not active (indicating no public active exploitation), a CVSS score of 6.5 (MEDIUM) and confidentiality impact warrant near-term attention. The broad attack surface (any website visit) and the ease of exploitation justify prioritization above lower-impact bugs. Organizations handling sensitive data or managing user-facing deployments should patch within 1–2 weeks. Standard patch cadences are appropriate for lower-risk environments.

Risk score, explained

The CVSS 6.5 (MEDIUM) score reflects: Network accessibility (AV:N) and no authentication required (PR:N), increasing attack surface significantly. User interaction (UI:R) provides a minor friction point. The high confidentiality impact (C:H) is the dominant factor, as memory disclosure can leak credentials, tokens, or personal data. No integrity or availability impact (I:N, A:N) keeps the score from reaching High severity. The score appropriately balances ease of exploitation against the real-world harm of information disclosure.

Frequently asked questions