CVE-2026-14100: Chrome NetworkCache Cross-Origin Data Leakage Vulnerability

Technical summary

The vulnerability stems from insufficient input validation in Chrome's NetworkCache subsystem prior to version 150.0.7871.47. NetworkCache manages cached network responses; the validation gap allows a remote attacker to craft HTML that triggers a cache lookup or response handling operation in a way that violates same-origin policy boundaries. The flaw is classified under CWE-20 (Improper Input Validation), indicating the root cause is inadequate checking of untrusted data before processing. Exploitation requires network access and user interaction (a victim must visit the attacker's page), but does not require special privileges or system-level modifications.

Business impact

Data leakage across security boundaries poses compliance and reputation risks. Affected organizations risk exposure of user session tokens, authentication cookies, or sensitive page content cached from third-party services. For enterprises relying on Chrome as a corporate browser, this could enable attackers to exfiltrate confidential information viewed during a single compromised session. Regulatory frameworks (GDPR, HIPAA, PCI-DSS) often mandate timely patching of known data-loss vulnerabilities, making delay costly.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on Windows, macOS, and Linux are directly affected. The vulnerability exists in a core Chrome component, meaning all Chrome deployments without the patch are at risk. Users of Chromium-based browsers (Edge, Brave, Opera) may also be affected depending on their sync cycle with upstream Chromium; verify with those vendors. Chrome on Android and iOS should be checked against vendor advisories for parallel fix status.

Exploitability

Exploitation is straightforward in terms of technical barriers: an attacker simply hosts a crafted HTML page and waits for a victim to visit it via a link, advertisement, or redirect. No sophisticated social engineering is required beyond standard phishing tactics. However, the vulnerability does not allow unauthenticated local privilege escalation or remote code execution; it is confined to data exposure within the browser's own process. Real-world impact depends on whether cached data of high value (session tokens, personal information) is present and accessible at the moment of exploitation.

Remediation

Immediate action: update Google Chrome to version 150.0.7871.47 or later via the built-in update mechanism (Help > About Google Chrome). Organizations with managed Chrome deployments should prioritize this patch in their update schedules. For users on Windows, macOS, and Linux, automatic updates typically apply within 24–48 hours unless disabled. Verify patch deployment using Chrome's version number (Settings > About).

Patch guidance

Google Chrome ships automatic security updates; most users will receive version 150.0.7871.47 automatically. To manually check and apply: open Chrome, navigate to Help > About Google Chrome, and the browser will detect and install pending updates. Enterprise administrators managing Chrome via Google Admin or similar tools should verify that update policies are active and that devices have checked in within the last 48 hours. No special configuration or restart is required beyond the standard update process. Test in a non-production environment if your organization has strict change-control policies.

Detection guidance

Detection at the network level is difficult because the exploit is a benign-looking HTML page request followed by cache operations internal to the browser. Host-based detection is similarly challenging: no new files, processes, or suspicious system calls signal the attack. The most practical detection approach is browser telemetry and user reports of unexpected data exposure. If your organization uses Chrome policies or Mobile Device Management (MDM), confirm that device Chrome versions report >= 150.0.7871.47. Incident response teams should monitor for user complaints of unexplained session hijacking or credential compromise that correlate with visits to untrusted or compromised websites.

Why prioritize this

Although Chromium's internal severity rating is 'Low,' the CVSS 3.1 score of 6.5 (Medium) reflects the real-world risk: confidentiality impact is high (C:H), but integrity and availability are unaffected. Cross-origin data leakage is a silent threat—users are unlikely to notice—yet exposes sensitive cached content. Prioritize patching for desktop users who handle high-value information and for employees in regulated industries. This is not a zero-day; the patch is available, making delay a discretionary risk.

Risk score, explained

CVSS 3.1 assigns a score of 6.5 (Medium) based on: Attack Vector = Network (exploitable remotely), Attack Complexity = Low (no special conditions needed), Privileges Required = None (attacker needs no account), User Interaction = Required (victim must visit the page), Scope = Unchanged (impact limited to Chrome process), Confidentiality = High (sensitive data exposed), Integrity = None, Availability = None. The score reflects that while the attack is easy to execute and broadly accessible, its impact is confined to data confidentiality without system-wide effects.

Frequently asked questions