CVE-2026-14107: Chrome Use-After-Free in Scheduling – Patch to 150.0.7871.47

Technical summary

CVE-2026-14107 is a use-after-free vulnerability (CWE-416) in Google Chrome's scheduling subsystem. The flaw allows memory previously freed by the scheduler to be referenced and executed, leading to arbitrary code execution within the Chrome sandbox. The vulnerability requires no special privileges or system-level access and can be triggered through a crafted HTML page delivered over the network. Successful exploitation results in code execution constrained by Chrome's sandbox isolation, limiting but not eliminating the security risk.

Business impact

Organizations relying on Chrome as a primary browser face potential data theft, credential compromise, and lateral movement risks if this vulnerability is exploited. Users working with sensitive data—financial records, intellectual property, authentication tokens—are at particular risk. The requirement for user interaction (visiting a malicious site) makes this suitable for targeted phishing campaigns or watering-hole attacks. The sandbox containment provides some defense but should not be relied upon as the sole protective layer.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The vulnerability affects Chrome deployments across Windows, macOS, and Linux systems. Apple macOS, Linux kernel, and Microsoft Windows platforms hosting vulnerable Chrome installations require attention. Organizations should inventory Chrome deployment versions and prioritize patching across all operating systems.

Exploitability

The vulnerability requires user interaction—specifically, a user must visit or be directed to a malicious webpage. This makes it suitable for phishing, targeted spear-phishing, or drive-by download scenarios. The attack surface is broad given Chrome's ubiquity. No special privileges are required, and the attack can originate from any network location. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of exploitation (crafted HTML page) suggests practical weaponization is feasible.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Verify the update through Chrome's Settings > About Google Chrome menu, which triggers automatic update checks and displays the current version. For enterprise deployments, use Chrome policy management tools to enforce updates across managed devices. Until patching is complete, limit user access to untrusted websites and reinforce security awareness around suspicious links and unexpected navigation prompts.

Patch guidance

Google has released Chrome 150.0.7871.47 containing the fix. Deploy this version or any subsequent release. Automatic updates are enabled by default in Chrome; however, verify completion within 24–48 hours for critical systems. Enterprise administrators should consult Google's official Chrome release notes and use their organization's device management system (MDM/EMM solutions, Group Policy for Windows, or managed Chrome policies) to confirm and enforce the patched version. No manual compilation or complex deployment steps are required—standard Chrome update procedures apply.

Detection guidance

Monitor for Chrome processes or browser-based process anomalies following user visits to untrusted or newly accessed sites. Behavioral indicators include unexpected child processes spawned from Chrome renderers, unusual memory allocations, and network connections initiated by Chrome after loading a crafted page. Endpoint detection and response (EDR) tools should alert on code execution within or escaping from the Chrome sandbox. Log and review Chrome crash reports and renderer process terminations, which may indicate exploitation attempts. Network-based detection is limited; prioritize endpoint telemetry and user reporting of unusual browser behavior.

Why prioritize this

This vulnerability merits high priority due to its CVSS 8.8 score, network-exploitability without authentication, and the ubiquity of Chrome in both consumer and enterprise environments. The requirement for user interaction slightly reduces urgency compared to worm-capable vulnerabilities, but the ease of social engineering users to click links makes real-world exploitation probable. The absence from the KEV catalog does not diminish risk; patching should begin immediately and complete within 1–2 weeks depending on your environment's risk tolerance.

Risk score, explained

The CVSS 8.8 score (HIGH severity) reflects a network-accessible vulnerability with low attack complexity, no privilege requirements, and high impact across confidentiality, integrity, and availability. Although confined to the Chrome sandbox, arbitrary code execution within that boundary can lead to credential theft, session hijacking, and data exfiltration. The required user interaction (UI:R) prevents this from reaching a critical 9.0+ score, but does not materially reduce exploitation probability in real-world phishing and social engineering scenarios.

Frequently asked questions