CVE-2026-14098: Chrome CSS Cross-Origin Data Leak

Technical summary

CVE-2026-14098 is a cross-origin data disclosure vulnerability in Google Chrome's CSS implementation. The flaw stems from inappropriate handling of CSS properties or behavior that allows a remote attacker to access information from cross-origin resources via a specially crafted HTML page. The attack vector is network-based with low complexity; the attacker must trick a user into visiting a malicious page. The vulnerability is tracked under CWE-200 (Information Exposure) and carries a CVSS v3.1 score of 6.5 (Medium severity). Chromium's internal severity assessment was Low, likely because exploitation depends on user action and the scope is limited to information disclosure without modification or service disruption.

Business impact

This vulnerability creates a data exposure risk for users of affected browsers. If an attacker successfully exploits it, they could exfiltrate sensitive information from web applications the user is accessing—such as authentication tokens, session data, or personal information—without the user or the target website being aware. For organizations whose employees use Chrome, this could increase the risk of compromised credentials or account takeover if users visit malicious sites. The requirement for user interaction (visiting a crafted page) somewhat limits the attack surface compared to zero-click exploits, but social engineering can overcome this barrier.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable on all major operating systems: Windows, macOS, and Linux. The source data lists Microsoft Windows, Apple macOS, and Linux kernel as affected platforms. Any system running a vulnerable Chrome version is at risk. Organizations should verify their Chrome deployment versions across all endpoints and prioritize patching this browser as part of their standard update cycle.

Exploitability

Exploitation requires two conditions: (1) a victim must visit a webpage controlled or compromised by the attacker, and (2) the attacker must craft specific HTML/CSS to trigger the cross-origin data leak. The attack is not self-propagating and cannot be executed remotely without user action, which moderately limits its exploitability. However, phishing, watering-hole attacks, or compromised advertisements could deliver the malicious page at scale. The low attack complexity and network vector indicate that once a user is on the attacker's page, successful exploitation is straightforward.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This version incorporates the fix for the CSS implementation flaw. Chrome typically auto-updates on most platforms; however, organizations should verify that updates have been applied and monitor for any delayed or failed updates in their fleet. Users can manually check for updates via Chrome menu > Help > About Google Chrome.

Patch guidance

Verify that your Chrome version is 150.0.7871.47 or newer. Most users and organizations will receive automatic updates; ensure your update policy does not delay or suppress Chrome patching. For macOS and Linux users, confirm the installed version matches or exceeds 150.0.7871.47. If you manage a fleet of Chrome instances (e.g., via Chromebook deployments or corporate managed installs), test the patch in a limited environment before full rollout to catch any compatibility issues, though Chrome patches at this level are typically low-risk.

Detection guidance

Direct detection of exploitation attempts is difficult without access to network traffic analysis, as the attack manifests as normal browser traffic to a malicious webpage. Organizations can monitor for suspicious browser behavior through endpoint detection and response (EDR) tools that track unusual network connections or data exfiltration patterns. Monitor user reports of unexpected cross-site requests or authentication anomalies. Conduct periodic audits of installed Chrome versions across endpoints to identify unpatched systems. If you suspect exploitation, check browser history for visits to unfamiliar domains and review authentication logs for unauthorized account access coinciding with the visit.

Why prioritize this

This vulnerability merits prompt attention because it enables silent data theft from legitimate websites without user or site awareness, and the attack can be delivered via social engineering or compromised web properties. While user interaction is required, the impact (confidentiality breach) is material. The CVSS Medium score reflects this balance of moderate access barriers and significant consequence. Chrome's ubiquity in enterprise and consumer environments amplifies the risk. Patching is straightforward due to auto-update mechanisms, making this a high-value, low-effort remediation.

Risk score, explained

The CVSS 6.5 (Medium) score reflects a network attack vector with low complexity and no privileges required, but with a requirement for user interaction. The impact is high confidentiality loss (sensitive cross-origin data leak) with no integrity or availability impact. The unchanged scope (U) indicates the vulnerability is confined to the Chrome process and does not escalate to the broader system. Chromium's internal 'Low' severity assessment suggests the actual exploitability in the wild is limited, but the potential impact is significant enough to warrant CVSS Medium classification.

Frequently asked questions