CVE-2026-14078: Chrome WebRTC Privilege Escalation Vulnerability – Patch 150.0.7871.47

Technical summary

CVE-2026-14078 is an input validation flaw (CWE-20) in the WebRTC subsystem of Google Chrome versions prior to 150.0.7871.47. The vulnerability permits remote privilege escalation when a user visits a specially crafted HTML page. The attack vector is network-based, the attack complexity is low, and user interaction (clicking a link or visiting a page) is required. No user privileges are needed to initiate the attack. The CVSS 3.1 score of 8.8 (HIGH severity) reflects high impact to confidentiality, integrity, and availability. Notably, while Chromium's internal severity classification is 'Low,' the CVSS assessment indicates substantial risk due to the privileges gained through successful exploitation.

Business impact

Exploitation could allow attackers to gain elevated privileges within the Chrome process, potentially compromising system security, accessing sensitive user data, and modifying or destroying information. For organizations where Chrome is a primary browser—especially those handling sensitive data or operating in regulated environments—successful attacks could lead to data exfiltration, lateral movement, and operational disruption. The requirement for user interaction moderates immediate risk but does not eliminate it in phishing or watering-hole attack scenarios.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. All operating systems running affected Chrome versions are at risk, including Windows, macOS, and Linux. Users of Chromium-based browsers (Edge, Brave, Opera, etc.) should verify patch status with their respective vendors, as they may inherit this vulnerability if they use the same WebRTC code path.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing or tricking a user to visit it. No authentication, special privileges, or complex setup is needed on the attacker side. The low attack complexity and network-based vector make this relatively straightforward to weaponize via phishing, watering-hole attacks, or compromised advertising networks. However, the requirement for user interaction provides a mitigation window—users who avoid suspicious links or keep their browsers updated reduce risk significantly.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. The patch addresses the input validation flaw in WebRTC. Organizations should prioritize this update for users in high-risk roles or those likely to encounter phishing or malicious content. Consider enforcing automatic updates where policies permit.

Patch guidance

Download and install Chrome version 150.0.7871.47 or later from google.com/chrome. On managed systems, deploy via your standard patch management tool or Chrome's enterprise update mechanism (if configured). Verify successful installation by navigating to Chrome menu > Settings > About, which will display the installed version and trigger immediate updates if needed. No workarounds exist; patching is the only reliable mitigation.

Detection guidance

Monitor for users visiting suspicious domains or clicking unusual links, particularly those impersonating trusted services. Web proxies and email security systems should flag emails with shortened URLs or requests to enable plugins. Endpoint detection and response (EDR) tools should monitor for unusual privilege escalation attempts or browser process behavior anomalies. Correlate Chrome crash reports with user browsing history to identify potential exploitation attempts.

Why prioritize this

Despite Chromium's internal 'Low' severity rating, the CVSS 8.8 score and privilege escalation capability warrant high priority. Privilege escalation vulnerabilities are strategically valuable to attackers and can serve as a stepping stone for further compromise. The low attack complexity and user-interaction-only requirement mean this is likely to be exploited in targeted campaigns. Immediate patching is justified.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects three critical factors: (1) network-based attack vector requiring no authentication; (2) low attack complexity, making it easy to exploit; (3) high impact on confidentiality, integrity, and availability through privilege escalation. The discrepancy with Chromium's 'Low' severity likely reflects differences in threat modeling—CVSS accounts for the ultimate impact (privilege escalation in an unsandboxed context), while Chromium may assess the immediate sandbox bypass difficulty.

Frequently asked questions