CVE-2026-14092: Chrome Cross-Origin Data Leak via Network Attack (CVSS 4.3)

Technical summary

CVE-2026-14092 stems from insufficient policy enforcement in Chrome's privacy mechanisms (CWE-693: Improper Neutralization of Special Elements used in an SQL Command). The vulnerability allows an attacker in a privileged network position—such as a rogue access point or compromised router—to craft malicious network traffic that leaks cross-origin data. The attack requires user interaction (clicking a link or visiting a page) but does not require authentication. Chrome's same-origin policy normally prevents JavaScript on one domain from accessing data on another; this flaw undermines that isolation when combined with network-level manipulation.

Business impact

Organizations whose employees use Chrome on corporate or personal devices face a moderate confidentiality risk. Sensitive data transmitted between a user's browser and web applications could be exposed to attackers on the same network segment. This is particularly concerning in shared network environments (offices, airports, coffee shops) where an attacker could intercept credentials, session tokens, or proprietary information. The vulnerability does not enable data modification or system compromise, limiting the blast radius, but credential theft remains a realistic secondary impact.

Affected systems

Google Chrome (all versions prior to 150.0.7871.47) on Windows, macOS, and Linux. Users of Chromium-based browsers (Edge, Brave, Opera) should verify whether they have received equivalent updates. The vulnerability does not directly affect other operating system components; it is specific to the Chrome browser.

Exploitability

Exploitability is moderate. An attacker must achieve a privileged network position (MITM capability) and convince a user to visit a malicious page or follow a crafted link. No zero-click or automated exploitation exists. However, network privilege is achievable in real-world scenarios (compromised Wi-Fi, ISP-level access, BGP hijacking), and social engineering to click a link is routine. Chromium rated this as Low severity internally, likely because it requires both network and user interaction; the CVSS 4.3 (Medium) reflects the broader risk when factoring in realistic attack chains.

Remediation

Update Chrome to version 150.0.7871.47 or later immediately. Patches for macOS and Linux are concurrent. Users can manually check for updates via Chrome Menu > Help > About Google Chrome, which will auto-download and install the latest version. Enterprise admins should push the update via their device management policies, targeting all Chrome instances company-wide. Verify successful deployment within 48–72 hours.

Patch guidance

Google has released Chrome 150.0.7871.47 as the stable patch. Windows, macOS, and Linux users will see the update available through the normal update mechanism; restart the browser to apply it. Organizations using Extended Support Release (ESR) or managed device deployments should consult the official Chrome security update timeline at security.google.com/chrome to confirm when their update branch receives the patch. Test in a non-production environment first if deployable via enterprise policy.

Detection guidance

Monitor browser version inventory to identify Chrome installations below 150.0.7871.47. Endpoint detection and response (EDR) platforms can flag outdated Chrome instances via asset discovery. Network intrusion detection systems (IDS) may detect MITM attacks attempting to inject malicious network traffic, though such detection is difficult without additional context. Focus detection efforts on identifying users on untrusted networks (public Wi-Fi) or those who visit high-risk domains; user education to avoid untrusted networks is more practical than technical detection.

Why prioritize this

While the Chromium severity is Low and CVSS is 4.3 (Medium), this warrants prompt patching because: (1) the attack targets browser isolation—a core security primitive; (2) network-level attacks are becoming more common; (3) Chrome is ubiquitous in enterprises; (4) the patch is low-risk and readily available. However, this is not a critical zero-day; it should not displace patching of higher-severity remote code execution or authentication bypass flaws. Schedule patching within your normal update cycle (aim for within 2 weeks), not as an emergency.

Risk score, explained

CVSS 4.3 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no special privileges required (PR:N), but mandatory user interaction (UI:R). The impact is confidentiality only (C:L, I:N, A:N), with no system availability or integrity risk. The score is borderline Medium/Low, making it a priority for privacy-sensitive environments but not an organization-halting incident.

Frequently asked questions