CVE-2026-14122: Chrome WebAppInstalls Arbitrary Read/Write on Windows

Technical summary

CVE-2026-14122 stems from insufficient input validation in the WebAppInstalls subsystem within Chromium on Windows platforms. The flaw permits arbitrary read/write access when a remote attacker crafts a malicious HTML page that exploits the validation gap. The attack surface is network-accessible and requires user interaction but no special privileges. The Chromium project classified the security severity as Low despite the CVSS 3.1 score of 8.1 (HIGH), likely because exploitation requires social engineering and is limited to the renderer process sandbox in most threat models; however, the ability to read and write arbitrary files elevates practical risk in Windows environments where the browser may operate with elevated permissions or access sensitive data.

Business impact

An attacker exploiting this vulnerability could exfiltrate sensitive files accessible to the Chrome process—including cached credentials, browsing history, locally stored application data, and personal documents—or modify files to inject malware, alter configuration, or disable security tools. In organizations where Chrome is the primary browser and users access it with standard or elevated privileges, this creates a pathway for data theft, credential compromise, and supply-chain-adjacent attacks. The user-interaction requirement reduces likelihood of large-scale automated attacks but does not eliminate risk in targeted campaigns or watering-hole scenarios.

Affected systems

Google Chrome versions prior to 150.0.7871.47 running on Microsoft Windows are affected. The vulnerability does not apply to Chrome on other operating systems (macOS, Linux, Android, iOS) based on the description. Users on the latest stable release—and those on extended stable or other release channels—should verify their installed version against the patch threshold. Enterprise deployments using Chrome via Google Chrome Enterprise or third-party management tools should audit rollout status.

Exploitability

The attack requires a victim to visit or interact with a malicious webpage; it does not work via email attachment, drive-by download, or any vector that bypasses user action. This human element significantly reduces the attack surface compared to zero-click vulnerabilities. However, attackers may use social engineering, ad networks, compromised legitimate websites, or targeted phishing to increase likelihood of user interaction. Once a user visits the malicious page, exploitation is reliable and no browser warnings or user confirmations are needed beyond the initial page load.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. On Windows systems, use Chrome's built-in auto-update mechanism (typically configured to update automatically) or manually check Help > About Google Chrome. For enterprise deployments, deploy updates via Google Update for Business (ADMX templates) or your Mobile Device Management (MDM) solution. Verify completion across all managed endpoints. Additionally, consider user awareness training to reduce the likelihood that employees visit malicious sites.

Patch guidance

Google Chrome updates automatically by default on most Windows installations, and users will see a notification to relaunch the browser once the patch is ready. IT administrators managing Chrome deployments should verify that their update policies are active and that version 150.0.7871.47 or higher is rolled out. Check the Chrome Version History (support.google.com) to confirm release notes. For environments with restricted internet access, pre-download the Chrome installer or use offline update mechanisms. No interim workarounds are documented; patching is the definitive mitigation.

Detection guidance

Monitor Chrome process execution and file-access patterns for anomalies: look for unexpected read operations on sensitive directories (e.g., %APPDATA%, %USERPROFILE%\Documents) or write operations to system directories during or shortly after a browser session. Endpoint Detection and Response (EDR) tools with behavioral analytics can flag suspicious file I/O correlated with Chrome. Network-level detection is limited because exploitation occurs after a victim visits a malicious webpage; focus on identifying the malicious site itself via URL filtering, DNS sinkholing, or web gateway logs. No known public exploits or indicators of compromise are available at this time.

Why prioritize this

Although classified as LOW severity by Chromium, this vulnerability scores 8.1 (HIGH) under CVSS 3.1 due to high impact (confidentiality and integrity both rated H) and ease of exploitation (network-accessible, low complexity, no privileges required). The discrepancy likely reflects Chromium's narrower sandbox threat model; however, in real-world Windows deployments where Chrome may access sensitive files or run with elevated context, the practical risk is substantial. Prioritize patching for users who access Chrome with high-privilege accounts or on systems storing sensitive data. Users on standard accounts with strong file-access controls face lower residual risk but should still patch promptly to prevent data exfiltration.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects a network-accessible flaw (AV:N) with low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction (UI:R). The high confidentiality (C:H) and integrity (I:H) ratings, coupled with unchanged scope (S:U), yield a score of 8.1 in the HIGH band. This accurately captures the severity of arbitrary read/write access. The gap between Chromium's LOW classification and CVSS's HIGH score is not unusual; CVSS measures intrinsic technical impact, while Chromium's severity accounts for sandboxing and exploitation difficulty in a fully patched system. Both metrics are valid; use CVSS to guide urgency and resource allocation.

Frequently asked questions