CVE-2026-14091: Chrome DevTools Use-After-Free Remote Code Execution (CVSS 8.8)

Technical summary

CVE-2026-14091 is a use-after-free vulnerability (CWE-416) in Chrome's DevTools subsystem. Use-after-free flaws occur when memory is accessed after it has been freed, potentially allowing attackers to read sensitive data or execute code. The vulnerability can be triggered via a specially crafted HTML page delivered over the network. Execution occurs within the browser sandbox, which provides some isolation from the host operating system, but sandbox escapes are a known attack vector. The vulnerability requires user interaction (clicking or viewing a link), which slightly raises the bar for exploitation compared to fully passive attacks.

Business impact

Organizations relying on Chrome for enterprise workflows face elevated risk if users visit untrusted websites or receive phishing emails with malicious links. Attackers gaining code execution within a sandboxed browser process could steal session cookies, exfiltrate cached credentials, harvest data from web applications, or pivot to further compromise. For security teams, the primary business impact is increased detection burden and the need for rapid patching cycles across large user populations. End-user machines, not servers, are the initial attack surface.

Affected systems

Google Chrome on Windows, macOS, and Linux systems running versions prior to 150.0.7871.47 are directly affected. The source data lists Chrome, macOS, Windows, and the Linux kernel as impacted platforms, indicating the vulnerability is cross-platform. Organizations should verify their Chrome version distribution across endpoints and prioritize patching. Note that while this is a Chrome-specific vulnerability, it affects users on all major operating systems.

Exploitability

The vulnerability requires a user to open or interact with a crafted HTML page—meaning the attacker must distribute the payload through phishing, drive-by downloads, malicious advertising, or compromised websites. A simple link click is sufficient; no additional user actions or system misconfigurations are needed beyond basic web browsing. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that attacks are network-accessible with low complexity, though they do require user interaction. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely confirmed at publication, but this does not guarantee safety.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome typically auto-updates on most systems, but users and administrators should verify completion. Organizations with managed Chrome deployments should use Group Policy (Windows) or MDM/EMM solutions to enforce version requirements. Until patched, users should avoid clicking links from untrusted sources and consider restricting access to known-malicious domains if possible. Disabling JavaScript or using content filtering may reduce risk, but these are not substitutes for patching.

Patch guidance

Verify that Chrome has updated to 150.0.7871.47 or later by navigating to Chrome menu > About Chrome, which should auto-download and apply patches. For enterprise environments, push updates through your mobile device management (MDM), configuration management, or browser deployment tools. Confirm patch adoption across your user base within 7–10 days. If Chrome auto-update is disabled in your environment, manually initiate updates or adjust policies to allow them. Test any custom browser extensions or web applications for compatibility with the patched version before broad rollout, though this vulnerability fix is unlikely to cause compatibility issues.

Detection guidance

Monitor Chrome crash logs and DevTools-related error messages for signs of exploit attempts, particularly in environments with restrictive network policies. Intrusion detection systems (IDS) may flag malicious HTML payloads if they contain known shellcode patterns, but custom exploits may evade signature-based detection. Focus on network telemetry: look for unexpected outbound connections from Chrome processes to command-and-control servers. Endpoint detection and response (EDR) tools should monitor for Chrome process spawning child processes or accessing sensitive files post-compromise. Browser history analysis can reveal whether users visited suspicious domains. No specific indicators of compromise are available until post-exploitation artifacts are observed.

Why prioritize this

Although Chromium's internal severity rating is low, the CVSS 3.1 score of 8.8 (HIGH) reflects the practical risk: remote network delivery, no authentication, high impact (confidentiality, integrity, availability), and low attack complexity. Use-after-free vulnerabilities in browser DevTools are historically attractive to attackers because DevTools often runs with elevated privileges relative to regular web pages. The attack vector is low-friction (clicking a link) and widespread (every Chrome user is exposed). Organizations should prioritize patching within their standard critical-update timeframe, especially for users handling sensitive data or accessing financial systems through the browser.

Risk score, explained

The CVSS 3.1 score of 8.8 results from: (1) Network-accessible attack vector (AV:N), (2) low attack complexity (AC:L), meaning no special conditions are required, (3) no privilege escalation needed (PR:N), (4) user interaction required (UI:R), which slightly lowers the score but does not eliminate risk, and (5) high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The disparity between Chromium's internal 'Low' severity and the CVSS 'HIGH' rating reflects the difference between Chromium's internal risk model (which may weight sandbox boundaries heavily) and the industry-standard CVSS assessment, which measures real-world exploitability and impact. For enterprise security decision-making, the CVSS score better reflects the true organizational risk.

Frequently asked questions