CVE-2026-14096: Chrome Android Input Handling Cross-Origin Data Leak

Technical summary

CVE-2026-14096 stems from improper input validation in Chrome's renderer process on Android. The vulnerability enables cross-origin data leakage when a compromised renderer processes a malicious HTML page. The attack chain requires prior compromise of the renderer—a high bar—but once achieved, attackers can exfiltrate confidential data across security boundaries. The Chromium security team classified this as Low severity; however, the CVSS 3.1 score of 6.5 reflects the confidentiality risk when considering the user interaction and network attack vector.

Business impact

For organizations managing Android-based devices with Chrome, this vulnerability presents a data exfiltration risk if users are targeted by attackers who've already achieved renderer compromise through other means (e.g., a separate Chrome vulnerability or malware). The primary concern is sensitive data leakage from authenticated sessions or cached content. Organizations handling high-sensitivity data on mobile platforms should treat this as a medium-priority patch to maintain confidentiality posture.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. Desktop and iOS versions of Chrome are not mentioned in this advisory. Organizations running Android devices with Chrome should assess their installed versions; Chrome's auto-update mechanism may have already deployed the fix in many environments.

Exploitability

Exploiting this vulnerability requires two preconditions: (1) the attacker must already have compromised the Chrome renderer process, and (2) the user must visit a crafted HTML page. The renderer compromise is non-trivial—it typically requires a separate vulnerability or sophisticated attack—making this vulnerability part of a multi-stage attack chain rather than a standalone threat. Public exploitation is not yet documented, and the issue remains classified outside the Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. Most Android devices with auto-update enabled will receive this patch automatically. Organizations should verify that managed devices are running the patched version and that auto-update policies are enforced for Chrome to minimize the window of exposure.

Patch guidance

Verify that your Android devices are running Chrome version 150.0.7871.47 or newer. Check Settings > About Chrome to view the current installed version; Chrome will auto-update if enabled. For managed environments, push this update through your mobile device management (MDM) platform and confirm successful deployment across your user base. The patch addresses the input validation flaw without requiring user reconfiguration.

Detection guidance

Detection of exploitation is difficult without behavioral analytics, as the attack requires prior renderer compromise. Monitor for unusual data exfiltration patterns from Chrome processes or abnormal cross-origin requests that bypass same-origin policy restrictions. In managed environments, track Chrome version telemetry to ensure patch compliance. Note that this vulnerability typically surfaces only as part of a broader attack; focus detection on the initial renderer compromise vector.

Why prioritize this

This issue merits prompt patching despite moderate CVSS and non-trivial exploitation requirements. The renderer compromise precondition does not eliminate risk—attackers may chain this with separate Chrome exploits. Organizations handling sensitive data on Android should prioritize keeping Chrome current to avoid opportunistic multi-stage attacks. The auto-update capability in Chrome reduces operational friction.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high impact on confidentiality (C:H) but accounts for the network attack vector and required user interaction. The score does not penalize the renderer compromise precondition as heavily as real-world risk analysis might, but it appropriately signals that patching should not be deferred indefinitely. Organizations with strict data protection requirements may treat this as higher priority than the base score suggests.

Frequently asked questions