CVE-2026-14079: Chrome Same-Origin Policy Bypass in Google Chrome 150.x

Technical summary

The vulnerability stems from insufficient policy enforcement in Chrome's Network component, enabling same-origin policy (SOP) circumvention. The same-origin policy is fundamental to browser security, restricting scripts loaded from one origin from accessing resources belonging to another. CWE-346 (Origin Validation Error) categorizes this class of weakness. An attacker crafts a malicious HTML page that exploits the enforcement gap, allowing cross-origin access that should be blocked. The vulnerability requires user interaction (opening the page) but no elevated privileges. Chromium's security team assigned a Low severity rating internally, though the CVSS 3.1 score of 4.3 (Medium) reflects moderate integrity impact without confidentiality or availability loss.

Business impact

A successful exploitation could expose users to credential compromise, session fixation attacks, and unauthorized data exfiltration from third-party services. If a user logs into their banking or email portal and then visits an attacker's malicious site, that site could steal session tokens or manipulate sensitive information. Organizations relying on Chrome for employee workflows or customer-facing services face reputational risk and potential compliance violations if user data is breached. The integrity-only impact (no confidentiality or availability loss) limits damage scope, but session-based attacks remain serious. Industries handling regulated data (healthcare, finance, education) should treat this with priority given trust and compliance requirements.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all Chrome releases on Windows, macOS, Linux, Android, and iOS running version 150.0.7871.46 or earlier. Chromium-based browsers that bundle unpatched versions of the affected component may also be vulnerable; organizations should verify their specific Chromium derivative against vendor advisories. Enterprise deployments using Chrome policy management should check their managed fleet version immediately.

Exploitability

The attack requires user interaction—specifically, the user must visit a malicious webpage. No special network positioning, code execution privileges, or complex technical prerequisites are needed beyond crafting the HTML exploit page. Attack surface is broad because any website an employee visits could host the exploit. The barrier to exploitation is low from an attacker perspective, though practical impact depends on user target value and attacker motivation. This is not a vulnerability that can be exploited passively or remotely without user action.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. The patch is available through Chrome's automatic update mechanism; most users running recent Chrome versions will receive the update automatically within hours of release. Verify the update by navigating to chrome://settings/help, which displays the current version and forces an update check. Organizations managing Chrome across fleets should use Chrome's policy tools (Google Admin Console or third-party MDM solutions) to enforce the update.

Patch guidance

Chrome updates are typically rolled out gradually to avoid mass instability. If automatic updates are disabled in your environment, manually trigger updates via chrome://settings/help or restart the browser. Enterprise administrators should verify rollout status via the Chrome Release Blog and Google's security advisories. Apply patches to all Chrome instances including those on employee endpoints, shared devices, and customer-facing kiosks. Test critical web applications after patching to ensure no regressions, though same-origin policy enforcement tightening should not break legitimate applications.

Detection guidance

Monitor Chrome version compliance across your fleet using device inventory tools or Mobile Device Management (MDM) platforms. Network-level detection of active exploitation is difficult because the attack vector is a crafted HTML page on the attacker's domain; traditional network signatures have limited value. Focus on preventative detection: flag or block users accessing known malicious sites, use endpoint detection and response (EDR) tools to monitor for unusual cross-origin API calls or abnormal browser behavior, and implement Content Security Policy (CSP) headers on your own web applications to restrict what third-party scripts can do. Browser security event logs may show policy violations if Chrome logging is configured; check chrome://net-internals if investigating suspected incidents.

Why prioritize this

Although Chromium internally rated this Low severity, the CVSS 4.3 Medium score and broad user-interaction attack surface warrant near-term patching. Same-origin policy bypasses directly threaten web application security, and the attack requires no special privilege or network position. Organizations with significant web application portfolios, cloud-based productivity tools, or regulated user bases should prioritize deployment within 1–2 weeks. The flaw is not currently listed as exploited in the wild (no KEV status), providing a window for proactive patching before active attacks emerge.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects an Attack Vector of Network, low Attack Complexity, no privileges required, and user interaction required. Scope is Unchanged and Confidentiality impact is None, but Integrity is Low. This means an attacker can modify or influence data or resources seen by the victim, but cannot read secrets or disrupt availability. The Medium rating is appropriate for a policy bypass that enables data manipulation but not direct theft or system failure. The Chromium Low rating reflects their narrower threat model; the CVSS Medium aligns better with real-world business risk in environments where session integrity matters.

Frequently asked questions