CVE-2026-14111: Chrome WebProtect Use-After-Free Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-14111 is a use-after-free vulnerability (CWE-416) in the WebProtect subsystem of Chromium. The flaw allows an attacker to craft a malicious Chrome extension that, when installed by a user, can trigger memory safety issues by referencing freed memory. This leads to arbitrary code execution in the context of the Chrome browser process. While Chromium's security team rated the underlying issue as Low severity, the CVSS 3.1 score of 8.1 (HIGH) reflects the practical impact: network-accessible attack vector, no authentication required, and full compromise of confidentiality, integrity, and availability. Exploitation requires user interaction (extension installation), which is why the CVSS Attack Complexity is High.

Business impact

An attacker who successfully exploits this vulnerability gains the ability to execute arbitrary code within Chrome's security context. This could enable credential theft, malware installation, data exfiltration, or lateral movement into corporate networks if the affected user has access to sensitive systems or credentials. The requirement to socially engineer extension installation reduces—but does not eliminate—the threat; targeted phishing campaigns or compromised extension marketplaces could scale exploitation. Organizations relying on Chrome as a primary browser face elevated risk if users cannot be reliably prevented from installing untrusted extensions.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected across all major operating systems: Windows, macOS, and Linux. Any user running a vulnerable Chrome build who installs a malicious extension is at risk. The vulnerability does not require specific hardware or software configurations beyond a vulnerable Chrome installation; it is platform-agnostic within the supported OS ecosystem.

Exploitability

Exploitation is feasible but requires a social engineering component. An attacker must convince a user to install a malicious extension—through phishing, trojanized distribution channels, or marketplace compromise. Once installed, the crafted extension can trigger the use-after-free condition to execute arbitrary code. The attack does not require user credentials or prior system compromise, and it works against unpatched Chrome instances with no additional interaction after extension installation. Practical exploitation has not been publicly disclosed, but the technical barrier is moderate for a skilled adversary with extension development knowledge.

Remediation

Users and administrators should immediately update Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will deploy the fix; administrators can verify deployment via Chrome's about:version page or enterprise management tools. Organizations should also reinforce extension installation policies: disable sideloading of extensions where possible, restrict installation to a whitelist of approved extensions, and educate users on the risks of installing extensions from untrusted sources.

Patch guidance

Update Chrome to version 150.0.7871.47 or later. For enterprise deployments: (1) Verify the patch is deployed across your Chrome fleet using management consoles or MDM solutions. (2) Monitor Chrome version compliance; enforce automatic updates if not already enabled. (3) Consider disabling extension installation via group policy or administrator settings for standard users, requiring admin approval for installation. (4) Test the patched version in your environment before enforcing to rule out compatibility issues with business-critical extensions. Note: Verify against official Google Chrome release notes and your vendor's advisory for any platform-specific deployment considerations.

Detection guidance

Monitor for suspicious Chrome extension installations, particularly from unknown or newly created marketplace accounts. Log and alert on: (1) Extension installations from sources outside your organization's approved list. (2) Extensions requesting unusual permissions (especially access to all sites, modification of network traffic, or raw socket access). (3) Chrome process crashes or abnormal memory behavior that could indicate exploitation attempts. (4) User reports of unexpected Chrome behavior after recent extension installation. Forensically, examine the Local State and Preferences files in Chrome's user data directory for recently installed extensions and their origins. Endpoint Detection and Response (EDR) tools should flag suspicious code execution originating from the Chrome process, particularly if it spawns child processes or accesses sensitive files.

Why prioritize this

Although the Chromium security team rated this as Low severity, the CVSS 8.1 HIGH score reflects the real-world impact. The vulnerability combines a network-accessible attack surface (extension installation via any Chrome instance), complete compromise of confidentiality, integrity, and availability, and platform-agnostic reach. The primary limiting factor is the requirement to socially engineer extension installation. For organizations with high-value users or those vulnerable to targeted phishing, this represents a material supply-chain-style risk. Prioritize patching for Chrome instances accessed by: sensitive user accounts, privileged staff, developers, and high-touch customer-facing roles. Standard user populations should be patched within standard patch windows.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) is derived from: (1) Attack Vector: Network (AV:N) — the vulnerability is reachable via the internet through extension distribution mechanisms. (2) Attack Complexity: High (AC:H) — exploitation requires social engineering and crafting a malicious extension. (3) Privileges Required: None (PR:N) and User Interaction: None (UI:N) — once the extension is installed, no further user action is needed. (4) Scope: Unchanged (S:U) — the impact is confined to the Chrome process and user account. (5) CIA Impact: All High (C:H/I:H/A:H) — arbitrary code execution grants complete compromise. The HIGH severity reflects practical exploitability despite the engineering effort required; it is not the highest severity because attack complexity and the need for extension installation introduce friction.

Frequently asked questions