CVE-2026-14090: Chrome CameraCapture Memory Read Vulnerability—CVSS 8.1 Patch Guide

Technical summary

CVE-2026-14090 involves insufficient input validation in the CameraCapture component of Chromium/Chrome (CWE-125: Out-of-bounds Read). The vulnerability permits a remote attacker to read memory beyond intended boundaries through a specially crafted HTML payload delivered over the network. No user privileges or local access are required; the attack vector is entirely network-based and depends only on user interaction (visiting a malicious site). The affected versions are Google Chrome and ChromeOS versions prior to 150.0.7871.47. Google's assessment as 'Low' severity likely reflects the controlled nature of the memory read, but the ability to exfiltrate confidential data (indicated by the CVSS 'C:H' component) elevates practical risk.

Business impact

An adversary exploiting this vulnerability could extract sensitive information from Chrome's process memory, including authentication tokens, cached credentials, browser history, or data from open tabs. This exposure is particularly concerning in corporate environments where Chrome is the primary browser and users frequently access cloud applications, email, and internal systems. Affected organizations face potential credential compromise, lateral movement vectors, and data exfiltration without detection at the browser level. ChromeOS endpoints, increasingly common in enterprise deployments, are directly at risk.

Affected systems

Google Chrome and ChromeOS versions prior to 150.0.7871.47 are vulnerable. The vulnerability requires an active user browsing the web; background or idle instances are not at risk. Both traditional Windows/Mac/Linux Chrome installations and ChromeOS devices are affected, though ChromeOS users may have faster automatic updates depending on organizational policy.

Exploitability

This vulnerability has a low barrier to exploitation. An attacker needs only to host a malicious HTML page and socially engineer or advertise it to potential targets. No special network positioning, zero-day kit, or sophisticated payload delivery is required. The reliance on user interaction (visiting the page) is a mild constraint but not a significant obstacle in real-world attack scenarios involving compromised websites, ad networks, or phishing campaigns. The attack is reliable and does not require user-level permissions or Chrome-specific features beyond normal browsing.

Remediation

Update Google Chrome and ChromeOS to version 150.0.7871.47 or later. For enterprise environments, verify your Chrome auto-update policies and confirm version rollout across all endpoints. ChromeOS devices typically update automatically, but administrators should validate that devices have checked in within a reasonable window. No workarounds are available; patching is the only effective mitigation.

Patch guidance

Prioritize patching Chrome on all user-facing devices, particularly those in business-critical roles or handling sensitive data. For ChromeOS environments, confirm that automatic updates are enabled and monitor device check-in status via your MDM/management console. Organizations on extended release channels should accelerate to stable release or manually apply patches if extended-release versions lag behind 150.0.7871.47. Test patch deployment in a small cohort first to ensure no regression with internal web applications or extensions.

Detection guidance

Network detection is challenging since the attack occurs within a legitimate browser session following a user visit to a malicious site. Focus on behavioral signals: monitor for unusual memory access patterns in Chrome processes, spikes in data exfiltration to unexpected destinations, or anomalous credential use following known malicious URL visits. Endpoint detection and response (EDR) tools can flag suspicious process memory reads, but signature-based detection is limited. Host-based anomaly detection and user and entity behavior analytics (UEBA) are more effective for identifying post-exploitation lateral movement or data theft. Collect browser history and DNS logs to correlate user visits to malicious or compromised domains with subsequent suspicious activity.

Why prioritize this

Despite Google's internal 'Low' severity assessment, the CVSS 3.1 score of 8.1 (HIGH) reflects realistic attack scenarios. Network exploitability, no authentication requirement, and high-confidence confidentiality impact make this a credential-theft vector suitable for targeted attacks and mass compromise campaigns. The vulnerability does not grant code execution or persistence, which caps the severity, but the ability to steal session tokens or authentication data is operationally significant. Prioritize patching for internet-facing users and those accessing sensitive cloud services.

Risk score, explained

The CVSS 3.1 score of 8.1 is driven by: (1) AV:N — network-based attack with no special access required; (2) AC:L — low attack complexity; (3) PR:N — no prior privileges needed; (4) UI:R — requires user interaction (visiting a page), a mild constraint; (5) S:U — impact is scoped to the user's security context; (6) C:H — high confidence of reading sensitive data; (7) I:N — no integrity impact (read-only); (8) A:H — potential for denial of service or application crash via memory exhaustion. The combination of high confidentiality impact and high availability risk justifies the HIGH severity label despite the lack of code execution or persistence.

Frequently asked questions