CVE-2026-14085: Google Chrome CSS Side-Channel Information Leakage

Technical summary

CVE-2026-14085 is a side-channel information disclosure vulnerability in the Cascading Style Sheets (CSS) processing layer of Chromium/Google Chrome. By crafting HTML pages that exploit timing or rendering artifacts in CSS computations, an attacker can infer properties of cross-origin resources that should be protected by the Same-Origin Policy. The vulnerability is classified under CWE-1300 (Information Exposure Through Timing Differences), indicating the attack relies on observable differences in how the browser processes requests or renders content. The attack surface is network-accessible and requires only that a user visit the attacker's page; no prior compromise or special browser configuration is necessary.

Business impact

For organizations where employees use Chrome on shared systems or access sensitive applications in the browser, this vulnerability poses a data theft risk. An attacker can harvest information from concurrent browser tabs—credentials, CSRF tokens, user IDs, or private business data—without triggering typical security alerts. The impact is elevated in environments where browsers are used for cloud applications, email, or internal dashboards. While the Chromium project assessed this as low severity, the CVSS score of 6.5 (Medium) reflects the practical consequence: confidentiality is fully compromised, but integrity and availability remain intact. Organizations should prioritize patching to prevent opportunistic attacks against users who may visit untrusted sites.

Affected systems

All versions of Google Chrome prior to 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, and Chrome-based browsers that use the same Chromium rendering engine. Organizations running enterprise Chrome deployments with auto-update disabled should verify their current version and push updates. Chromium-based browsers (Edge, Brave, etc.) may also be affected if they have not independently patched this CSS processing flaw; check vendor advisories for those products.

Exploitability

Exploitability is moderate. An attacker must host a crafted HTML page and socially engineer or advertise it to potential victims. The user must visit the page while having other sensitive tabs open. There is no requirement for phishing, malware installation, or user permission bypass—only user interaction. Automated scanning tools may not detect affected systems without checking browser version strings. The attack is reliable once a user is on the malicious page; it does not depend on browser extensions, plugins, or rare configuration. However, the attack surface is limited to users who actively browse untrusted content, making it less critical than a local privilege escalation or remote code execution vulnerability.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Use Chrome's Settings > About Chrome to check for automatic updates, or manually trigger the update process. For enterprises, deploy the patch through your mobile device management (MDM) or endpoint management system if you manage Chrome deployments. Verify that auto-update is enabled for end-user machines. No workarounds (like disabling CSS or specific browser features) are practical; patching is the only reliable fix. Test the patch in a small group before wide rollout if your organization requires change control.

Patch guidance

Google Chrome 150.0.7871.47 and later versions contain the fix. Update through Settings > About Chrome, which will automatically download and install the patch (browser restart required). For enterprise deployments, ensure your Chrome management policies are not preventing auto-update. Verify the patched version by opening Chrome Settings > About Chrome and confirming the version number matches or exceeds 150.0.7871.47. No additional configuration or activation is required after patching. Consider scheduling updates during low-impact windows if your users depend on continuous browser availability.

Detection guidance

Identify vulnerable instances by querying browser version information from your endpoint management tools or security agents that report software inventory. Look for Chrome versions below 150.0.7871.47 in your device fleet. If your organization uses Chrome Enterprise Reporting, filter for affected versions. Monitor network logs for traffic to known or suspicious sites that might host CSS side-channel exploits (this is difficult without behavioral analysis). Implement a browser version policy in your MDM to enforce minimum Chrome versions and block outdated releases from connecting to corporate networks. In incident response, check browser history on affected systems for visits to untrusted or unusual domains if you suspect exploitation.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 6.5 (Medium) and the requirement for user interaction place it below critical remote code execution flaws, but the widespread use of Chrome in business environments and the ease of exploitation once a user lands on a malicious page justify moving it into the standard patch cycle. Prioritize systems used by employees who access sensitive cloud applications, email, or internal portals. If your organization has high-value targets (executives, developers, finance teams) who use Chrome, accelerate patching for their machines.

Risk score, explained

The CVSS score of 6.5 reflects a Medium severity: the attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges are required (PR:N), and user interaction is required (UI:R). Confidentiality is highly impacted (C:H)—an attacker can fully read cross-origin data—while integrity and availability are not affected (I:N, A:N). The scope is unchanged (S:U), meaning the attack does not break out of the browser sandbox or affect other processes. This is not a low-severity flaw despite Chromium's internal rating, because cross-origin data leakage is a serious breach of web security boundaries. The score appropriately penalizes the requirement for user interaction but rewards the ease of attack once that interaction occurs.

Frequently asked questions