CVE-2026-14074: Chrome iOS WebAuthentication Side-Channel Information Leak

Technical summary

CVE-2026-14074 is a side-channel information leakage vulnerability in the WebAuthentication API implementation within Google Chrome for iOS. The vulnerability stems from information being inadvertently disclosed across origin boundaries, enabling a remote attacker to infer or extract sensitive data via carefully crafted HTML content. The attack leverages observable differences in API behavior or timing when authenticating credentials—a common pattern in side-channel attacks. Affected versions include Chrome prior to 150.0.7871.47 on iOS. While Google classified this internally as Low severity, the CVSS 3.1 score of 6.5 reflects the confidentiality impact and the fact that exploitation requires user action to visit an attacker-controlled page.

Business impact

This vulnerability primarily threatens user privacy on iOS devices. If exploited, attackers could infer which websites or services a user is authenticated to, potentially enabling targeted phishing, account enumeration, or social engineering attacks. For organizations, the risk is chiefly to employee device security when staff use Chrome on iOS for corporate authentication or access to sensitive web applications. The cross-origin data leakage could compromise authentication flows and expose organizational membership or service usage patterns. However, the requirement for user interaction to visit a malicious page limits the attack surface in controlled environments.

Affected systems

Google Chrome for iOS versions prior to 150.0.7871.47 are affected. This includes all Chrome installations on Apple iPhone OS that have not been updated to the patched version. Android and desktop Chrome versions are not impacted by this specific vulnerability. The issue is specific to iOS due to architectural differences in how Chrome implements WebAuthentication on that platform.

Exploitability

Exploitation requires two preconditions: (1) the victim must be using an affected version of Chrome on iOS, and (2) the victim must visit an attacker-controlled website that hosts the crafted HTML payload. There is no network-based or local exploitation pathway. The attack is probabilistic in nature—the attacker observes side-channel behaviors (such as timing differences or API response patterns) rather than directly reading memory or executing code. This makes reliable exploitation dependent on careful payload design and repeated observations. No public proof-of-concept or active exploitation has been tracked in the KEV catalog.

Remediation

Update Google Chrome on iOS to version 150.0.7871.47 or later. This patch resolves the side-channel leak by hardening the WebAuthentication API against timing and behavioral inference attacks. Users should enable automatic app updates in the App Store, and enterprise administrators should push the update to managed devices. No configuration changes are necessary; patching is the sole remediation.

Patch guidance

Verify the installed version of Chrome on iOS by launching the app, navigating to Settings > About Chrome, and confirming the version number. If the version is below 150.0.7871.47, initiate an update immediately. For personal devices, enable App Store automatic updates to prevent future delays. For enterprises managing iOS devices via MDM, deploy Chrome 150.0.7871.47 or later through your management platform's app distribution mechanism. Rollout can typically begin immediately; there are no known compatibility issues or breaking changes in this patch.

Detection guidance

Monitor for users accessing or lingering on suspicious websites, particularly those advertising authentication or credential verification tools. On networks with web traffic inspection capability, look for HTML pages using WebAuthentication API calls (detector.webauthn patterns or navigator.credentials patterns) combined with timing measurement libraries. Endpoint Detection and Response (EDR) tools on iOS may have limited visibility, but note that actual data exfiltration would occur over HTTPS, making behavioral detection difficult without API-level inspection. Focus detection efforts on identifying compromise of downstream accounts that use cross-origin authentication schemes.

Why prioritize this

Although the internal Chromium severity is Low, this CVE warrants prompt patching due to its direct impact on user privacy and authentication security. The CVSS 6.5 Medium rating reflects the confidentiality impact and the broad user base of Chrome on iOS. The vulnerability is not yet exploited in the wild (KEV status: false), providing a window to patch proactively. Organizations with significant iOS user bases or those using iOS for enterprise authentication should deprioritize this above critical vulnerabilities but treat it as a high-priority update cycle item.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is driven by high confidentiality impact (C:H), no integrity or availability impact, and network-based attack vector with low complexity (AV:N, AC:L). The requirement for user interaction (UI:R) moderates the score from a higher severity band. Compared to remote code execution vulnerabilities, this is less severe, but compared to vulnerabilities with no data exposure risk, it carries meaningful risk. The score appropriately reflects that while the attack surface is narrow (iOS Chrome only), the potential for privacy breaches justifies a Medium severity classification.

Frequently asked questions