CVE-2026-14102: Use-After-Free in Google Chrome Passwords – Patch Chrome 150.0.7871.47

Technical summary

CVE-2026-14102 is a use-after-free (CWE-416) vulnerability affecting Chrome's Passwords component. The flaw arises from improper memory management where freed memory is accessed after deallocation, enabling heap corruption. The attack vector is network-based with low complexity and requires user interaction through HTML content delivery. No special access or privileges are required from the attacker's perspective. While Chromium classified this as Low severity internally, the CVSS 3.1 score of 8.8 reflects the high impact potential of heap corruption leading to confidentiality, integrity, and availability compromise.

Business impact

A successful exploit allows remote code execution in the context of the Chrome browser process, granting an attacker the ability to steal sensitive data (including passwords and browsing history), modify data, or crash the browser. For organizations where Chrome is a primary browser, particularly those handling sensitive credentials or data through web applications, this vulnerability poses a direct risk to user security posture and data protection compliance obligations.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. All platforms running vulnerable Chrome versions—Windows, macOS, Linux, and Chrome OS—are in scope. Organizations should audit their Chrome deployment versions across endpoints to identify exposure.

Exploitability

Exploitation requires a user to visit a crafted website, making it practical for targeted campaigns or watering hole attacks. The attack requires no special privileges or authentication, and the low attack complexity means the exploit is feasible without unusual or fragile conditions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the published date, but the straightforward attack surface warrants defensive prioritization.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Organizations should enforce automatic updates or push this version through their Chrome deployment mechanisms. Verify the update applies to all managed Chrome installations across Windows, macOS, and Linux environments.

Patch guidance

Deploy Chrome 150.0.7871.47 or a later stable release via your organization's patch management system. Chrome's automatic update mechanism typically addresses this within days of release; however, managed enterprises should verify patch deployment status through Chrome's enterprise admin console or equivalent monitoring tools. Test the patched version in a controlled environment before broad rollout if your organization has critical Chrome-dependent workflows.

Detection guidance

Monitor for signs of exploitation by tracking Chrome crash reports and collecting browser logs from endpoints. Look for unexpected heap corruption errors in Chrome logs or abnormal termination patterns. Network-level detection is challenging since the attack vector is HTML content; however, monitoring for suspicious domain access or anomalous HTTP requests to known malicious infrastructure can provide context. Endpoint detection and response (EDR) tools should flag heap corruption or unexpected code execution within chrome.exe or chromium processes.

Why prioritize this

Although CVSS 8.8 indicates high severity and the attack surface is broad (any website visit), the lack of known public exploitation and active use in the wild allows for a measured but urgent patching timeline. Prioritize patching for endpoints belonging to high-value targets (executives, finance, engineering teams handling credentials) or those exposed to untrusted web content. Given the password management component, credential compromise risk elevates this beyond typical browser vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with low attack complexity, user interaction required, and high impact across all three security dimensions (confidentiality, integrity, availability). The use-after-free in password management amplifies risk because the Passwords component handles sensitive authentication material. The Chromium team's 'Low' severity designation appears to reflect their internal methodology; however, the ability to trigger heap corruption and achieve code execution justifies the elevated CVSS rating.

Frequently asked questions