CVE-2026-14105: Chrome Speech API Same-Origin Policy Bypass – Patch v150.0.7871.47

Technical summary

CVE-2026-14105 involves insufficient policy enforcement within Chrome's Speech API implementation, specifically in the same-origin policy (SOP) enforcement mechanism. The vulnerability is rooted in CWE-346 (Origin Validation Error) and allows a remote, unauthenticated attacker to bypass SOP protections via a specially crafted HTML page. The attack requires user interaction (clicking, navigating) but no special privileges. The vulnerability affects the integrity of cross-origin data flows but does not enable confidentiality breaches or denial of service under the assessed conditions.

Business impact

For organizations relying on web applications that use Chrome's Speech API for sensitive operations—such as voice-controlled interfaces, accessibility features, or voice authentication—this vulnerability could allow attackers to exfiltrate or manipulate speech input across domain boundaries. The risk is primarily to data integrity rather than widespread system compromise. Enterprises should assess whether their internal or customer-facing applications depend on Speech API functionality and whether cross-origin injection could lead to user-impersonation or data tampering scenarios.

Affected systems

Google Chrome browser versions prior to 150.0.7871.47 are affected. Any user running an unpatched version of Chrome on Windows, macOS, Linux, Android, or iOS is potentially vulnerable if they visit a malicious web page. The vulnerability does not affect other Chromium-based browsers unless they similarly fail to properly enforce Speech API origin policies, though vendors should verify their own implementations.

Exploitability

Exploitability is moderate. An attacker must craft a convincing or trick a user into visiting a malicious webpage; there is no remote code execution or automatic exploitation. The attack surface is limited to users of the Speech API or web applications embedding it. No active exploitation has been observed in the wild (KEV status is inactive), and the technical barrier to weaponization is moderate—an attacker needs to understand Speech API mechanics and origin policy semantics. User awareness and safe browsing practices reduce risk significantly.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Google's security team has addressed the policy enforcement gap in this release. Users should enable automatic updates if not already enabled, which will deploy the patch without manual intervention. Organizations managing Chrome deployments should verify patch rollout through their mobile device management (MDM) or endpoint management systems.

Patch guidance

Verify that Chrome has been updated to 150.0.7871.47 or a newer version by navigating to Chrome Settings > About Chrome, which will display the current version and initiate an automatic check for updates. For enterprise deployments, use Chrome policies (via Group Policy on Windows or equivalent mobile management tools) to enforce the minimum version. Test patched browsers against internal applications that use the Speech API to ensure compatibility and correct functionality post-update.

Detection guidance

Monitor browser version inventory across your organization to identify machines running Chrome versions below 150.0.7871.47. Web application firewalls or network sensors should flag requests attempting to access speech-related endpoints from unexpected origins, though detection of this specific bypass requires deep inspection of browser behavior. For defense-in-depth, review Content Security Policy (CSP) headers on applications using the Speech API to ensure they restrictively specify allowed origins.

Why prioritize this

Although Chromium's severity assessment is 'Low' and CVSS is 4.3 (Medium), the vulnerability warrants timely patching because it directly undermines the same-origin policy—a foundational web security boundary. Organizations with Speech API-dependent applications or accessibility-heavy user bases should prioritize patching. However, this is not a zero-day or actively exploited threat, so it should not disrupt more critical remediation efforts.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-adjacent attack vector, low attack complexity, and no privileges required, but limited impact (integrity only, no confidentiality loss or availability impact). The score appropriately captures a boundary violation rather than a critical system compromise. The absence of KEV (Known Exploited Vulnerability) listing indicates no real-world weaponization; this remains a theoretical risk vector requiring user interaction to trigger.

Frequently asked questions