CVE-2026-14086: Google Chrome HID Remote Code Execution Vulnerability

Technical summary

CVE-2026-14086 stems from insufficient policy enforcement in the HID subsystem of Chromium-based Chrome. The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code through a specially crafted HTML page. The attack vector is network-based with low complexity; no special privileges or user authentication is required beyond user interaction (UI:R). The impact is severe: the vulnerability permits complete compromise of confidentiality, integrity, and availability within the affected process context. The underlying weakness is classified as CWE-602 (Client-Side Enforcement of Server-Side Security), indicating that trust or permission validation is not properly enforced on the client side.

Business impact

Successful exploitation could lead to malware installation, data theft, credential harvesting, or lateral movement within corporate environments. Employees visiting compromised or malicious websites could unknowingly trigger code execution, bypassing traditional perimeter defenses. Organizations relying on Chrome as their primary browser face elevated risk of infection and data loss. The vulnerability's ease of exploitation (low complexity, no authentication required) and high impact make it a significant business concern, particularly for organizations with strict data protection or compliance requirements.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all Chrome installations on Windows, macOS, Linux, Android, and iOS that have not been updated to version 150.0.7871.47 or later. Chromium-based browsers that incorporate unpatched HID handling code may also be at risk; verify with individual vendor advisories.

Exploitability

The vulnerability is highly exploitable. Attack complexity is low, requiring only that a user visit a malicious or compromised webpage—no special user actions or privileges are needed beyond clicking a link or viewing embedded content. The attack surface is broad: any website or email with embedded HTML content could potentially serve as an attack vector. The Chromium project classified this as 'Low' severity internally, though the CVSS 3.1 score of 8.8 (HIGH) reflects the serious real-world impact. The discrepancy likely stems from Chrome's sandbox architecture limiting direct OS-level harm, though user-level compromise remains complete.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Perform a full browser restart after updating to ensure the patched code is loaded. Organizations should deploy automated update mechanisms or use managed Chrome deployment tools (Google Admin Console, Intune, etc.) to ensure fleet-wide patching. For users unable to update immediately, restrict browsing to trusted, controlled sites only.

Patch guidance

Google Chrome will deliver this fix via its normal auto-update mechanism. Users can manually check for updates by navigating to Chrome menu > About Google Chrome, which will trigger an update check and install available patches. Enterprise administrators should consult Google's Chrome Release Blog and security advisory channels for deployment guidance. Verify that Chrome has restarted and is running version 150.0.7871.47 or later by checking Chrome > About.

Detection guidance

Monitor for unexplained Chrome process crashes or restarts that may indicate exploitation attempts. Endpoint Detection and Response (EDR) tools should flag unusual child processes spawned from Chrome or suspicious code injection into chrome.exe/chromium processes. Network security tools can monitor for traffic to known malicious HTML-hosting domains. Browser telemetry and crash reporting data can help identify exploitation attempts at scale. Additionally, monitor for creation of suspicious files or registry modifications that may result from successful code execution post-exploitation.

Why prioritize this

Although the Chromium project rated this as 'Low' severity, the CVSS 3.1 score of 8.8 (HIGH) and the practical ease of exploitation warrant immediate prioritization. Remote code execution via a simple web visit, with no authentication or special user action required, poses a severe risk. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but its low barriers to exploitation suggest it could be weaponized quickly. Organizations should prioritize this update within 24-48 hours, particularly for user-facing systems.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a HIGH severity rating driven by: (1) network-based attack vector requiring no special privileges, (2) low attack complexity, (3) minimal user interaction needed, (4) complete compromise of confidentiality, integrity, and availability. The score is appropriately calibrated to real-world risk, despite Chromium's internal 'Low' classification—which likely emphasized sandbox containment rather than the severity of user-level compromise. Any organization with Chrome deployments should treat this as a critical update priority.

Frequently asked questions