CVE-2026-14084: Google Chrome Chromoting Heap Corruption (CVSS 8.8)

Technical summary

CVE-2026-14084 is an insufficient input validation flaw (CWE-20) in Google Chrome's Chromoting component affecting versions prior to 150.0.7871.47. The vulnerability permits remote heap corruption triggered by malicious network traffic. The CVSS 3.1 score of 8.8 (HIGH) reflects the attack vector over the network, low complexity, no privilege requirement, and requirement for user interaction, with high confidentiality, integrity, and availability impact. Despite Chromium's internal severity rating as "Low," the CVSS vector indicates the vulnerability poses significant risk in real-world scenarios.

Business impact

Exploitation of this vulnerability could enable attackers to compromise user systems running affected Chrome versions through remote access sessions. An attacker could leverage a malicious Chromoting connection to gain unauthorized code execution, steal sensitive data, modify information, or disrupt availability. For organizations deploying Chrome for remote work or support scenarios, this represents a credential-less entry point if a user inadvertently accepts a connection from an untrusted source or if an attacker intercepts the connection setup.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. Chromoting is Chrome's built-in remote access feature, so any Chrome installation with remote access capabilities is potentially in scope. Users who do not use or have disabled Chromoting functionality face reduced risk, though the component is enabled by default in standard Chrome deployments.

Exploitability

The vulnerability requires network-level access and user interaction to trigger (such as initiating or accepting a remote session). An attacker cannot exploit this silently or without the target user's involvement. However, the low complexity and lack of privilege requirement mean that once user interaction occurs, exploitation is straightforward. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting no evidence of active exploitation in the wild as of the publication date.

Remediation

Users should upgrade to Google Chrome version 150.0.7871.47 or later immediately. Organizations should enforce automatic updates or deploy Chrome through managed channels to ensure rapid patch deployment. For systems where immediate patching is not feasible, disabling Chromoting via Chrome policies or administrative settings provides temporary risk reduction, though this limits legitimate remote access functionality.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. Chrome typically auto-updates on restart, but users can manually check for updates via Chrome menu > Settings > About > Google Chrome. For enterprise deployments, use Chrome policy management to enforce the minimum version requirement via the 'MinimumChromeVersion' or 'CriticalExtensionUpdateTimeoutInSeconds' policies. Verify patch installation by confirming the Chrome version in chrome://version.

Detection guidance

Monitor for unexpected Chromoting connections, particularly to external or untrusted hosts. Implement network segmentation to restrict Chromoting traffic to trusted networks. Log and alert on Chrome crashes or abnormal process termination related to Chromoting services. User agents or browser isolation solutions may detect anomalous remote session behavior. Endpoint detection and response (EDR) tools should flag suspicious memory corruption patterns or exploitation attempts targeting Chrome processes.

Why prioritize this

Although not listed in CISA's KEV catalog, the HIGH CVSS score (8.8) combined with the ubiquity of Chrome, the accessibility of Chromoting features, and the severity of potential impact (code execution) warrant immediate patching priority. The requirement for user interaction slightly lowers urgency compared to wormable flaws, but organizations should treat this as a critical patch cycle item given Chrome's prevalence and the potential for targeted attacks against remote work scenarios.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a high-severity vulnerability: remote attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The impact is severe across all three dimensions—confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H)—indicating potential for full system compromise. This discrepancy with Chromium's internal "Low" severity likely reflects Google's internal risk model; the CVSS score better reflects external threat landscape considerations.

Frequently asked questions