CVE-2026-14082: Chrome Storage Race Condition Enables Cross-Origin Data Leakage

Technical summary

CVE-2026-14082 is a race condition (CWE-362) in Chrome's storage handling mechanism. The flaw permits a remote attacker to engineer a timing-dependent scenario where cross-origin data becomes accessible via crafted HTML. The attack surface requires network access and user interaction (visiting a malicious page), but does not require authentication or user configuration changes. The vulnerability affects Chrome versions prior to 150.0.7871.47. The race condition likely stems from insufficient synchronization or locking in storage access paths, creating a narrow but exploitable window where origin-based isolation can be circumvented.

Business impact

The primary risk is confidential data leakage. An attacker hosting a malicious website could potentially extract sensitive information from users' sessions with other sites—such as authentication tokens, personal details, or account information—if those sites are also open in the victim's browser. Organizations relying on Chrome for secure web application access should prioritize patching to maintain data confidentiality guarantees. The real-world impact depends on user browsing habits and whether sensitive services are accessed in the same browser instance as untrusted content.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. This includes stable, extended, and dev channel releases below the fixed version. Chrome on Windows, macOS, Linux, Android, and iOS—any platform running affected Chrome versions—requires patching. Enterprise Chrome deployments managed via group policy or similar mechanisms should verify their pinned or deployed versions against the 150.0.7871.47 threshold.

Exploitability

The attack requires a user to visit a malicious or compromised webpage (user interaction). No special browser settings, extensions, or permissions are needed. However, the vulnerability is a race condition, which typically means exploitation success depends on precise timing; attackers would need to reliably trigger the condition, and success rates may vary. The requirement for user interaction—while a limiting factor—does not significantly impede real-world exploitation, especially in phishing or drive-by download scenarios. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Google's automatic update mechanism will push this version to most users; verification can be done via Settings > About > Google Chrome. Enterprise administrators should verify deployment across managed systems and confirm rollout completion. For users unable to immediately patch, minimizing browsing of untrusted sites while sensitive services are also open in the same browser instance reduces exposure.

Patch guidance

Automatic updates: Most Chrome users will receive version 150.0.7871.47 automatically. Check Settings > About Google Chrome to verify the installed version (it will auto-update if older). Manual verification: Confirm your version matches or exceeds 150.0.7871.47 before resuming high-risk browsing. Enterprise deployment: Use Chrome's group policy templates or mobile device management (MDM) to enforce minimum version 150.0.7871.47 across your fleet. Rollout testing: Validate functionality of internal web applications against the new Chrome version before forcing enterprise-wide deployment.

Detection guidance

Direct detection of exploitation is difficult because the attack is a timing-dependent race condition executed client-side in the browser. Network detection: Monitor for traffic to known malicious domains that have advertised such exploits. Endpoint detection: Watch for unexpected data exfiltration from browsers, though this would be visible only if subsequent attacker activity triggers alerts. Browser telemetry: Enable Chrome Enterprise reporting to monitor version compliance; out-of-date browsers indicate potential vulnerability exposure. The most practical approach is version enforcement and user awareness training on not visiting untrusted sites while sensitive services are active.

Why prioritize this

Although Chromium itself rates this as 'Low' severity, the CVSS score of 6.5 (Medium) reflects the high confidentiality impact—exposure of cross-origin data violates a fundamental browser security principle. Prioritize patching on systems handling sensitive data (finance, healthcare, government, etc.) where cross-origin data leakage poses material risk. Users and enterprises focused on general web browsing can patch within standard monthly patch cycles. The lack of KEV status and active exploitation reporting allows for standard, non-emergency patching schedules, but should not delay timely deployment.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: network-based attack vector (AV:N), low attack complexity suggesting reliable reproducibility (AC:L), no special privileges required (PR:N), but user interaction needed (UI:R). The confidentiality impact is rated high (C:H) because cross-origin data exposure breaches core browser isolation. Integrity and availability are unaffected (I:N, A:N). The scope is unchanged (S:U), meaning the vulnerability does not impact resources outside the vulnerable component's security scope. This score appropriately positions the vulnerability as requiring prompt patching but not an emergency hotfix.

Frequently asked questions