CVE-2026-14125: Chrome ANGLE Memory Disclosure Vulnerability – Patch to 150.0.7871.47

Technical summary

CVE-2026-14125 is an uninitialized use vulnerability (CWE-457) in ANGLE, the graphics abstraction layer embedded in Chrome. The flaw allows a remote attacker to access uninitialized memory regions through specially crafted HTML rendering. When graphics operations process the crafted content, memory that was never properly initialized becomes readable to JavaScript or rendering contexts, creating an information disclosure channel. Google's own severity assessment rated this as Low within Chromium, though the CVSS score reflects the potential impact when considering network-based exploitation and user interaction factors.

Business impact

This vulnerability represents a confidentiality risk for Chrome users, particularly in environments where users may visit untrusted or compromised websites. An attacker could potentially extract authentication tokens, session cookies, cached credentials, or other sensitive data resident in process memory. While the immediate exploitation requires a user to visit a malicious page, the data at risk could extend beyond the current browsing session if sensitive information is cached in memory. Organizations relying on Chrome in security-sensitive roles should treat this as a prompt remediation priority.

Affected systems

The vulnerability affects Google Chrome versions prior to 150.0.7871.47. Because ANGLE is a core graphics component, the flaw indirectly impacts all platforms where Chrome runs, including Windows, macOS, and Linux systems. The vendor_product list reflects these platform dependencies, though the actual vulnerability resides in the Chrome binary and ANGLE implementation rather than in the operating systems themselves.

Exploitability

Exploitation is relatively straightforward: an attacker crafts a malicious HTML page and waits for or directs users to visit it. No authentication, special network positioning, or client-side vulnerabilities are required—the attack surface is simply the web. However, the attacker cannot trigger the vulnerability remotely without user interaction; the victim must visit the malicious content. The information disclosed depends on what data happens to be in memory at the time of exploitation, making each attack somewhat unpredictable but potentially valuable.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This version includes a fix that ensures ANGLE properly initializes memory regions before use, closing the information disclosure channel. Users should enable automatic updates if not already configured. Organizations managing Chrome deployments should prioritize this update in their patch management cycle, particularly for systems where users access untrusted content or where sensitive data may be cached in process memory.

Patch guidance

Verify the installed Chrome version by navigating to Chrome menu > Help > About Google Chrome, which will display the current version and automatically check for updates. For enterprise deployments, ensure your Chrome release channel is set to receive version 150.0.7871.47 or higher. Test the patch in a non-production environment to confirm compatibility with any custom extensions or applications that depend on Chrome's rendering engine. Consider synchronizing Chrome updates with your organization's change management process, as no major breaking changes are anticipated with this security patch.

Detection guidance

Monitor Chrome crash reports and GPU process logs for unusual memory access patterns or renderer process terminations that could indicate exploitation attempts. Implement network-based detection by identifying and blocking known malicious domains hosting exploit pages. Endpoint detection and response (EDR) tools should flag suspicious JavaScript activity or WebGL/graphics API calls that attempt to read uninitialized memory. Web filtering solutions can help prevent users from accessing malicious sites by categorizing or blocking suspicious content based on threat intelligence feeds.

Why prioritize this

Although Google rated this as Low severity within Chromium, the CVSS 6.5 Medium score reflects the practical impact of memory disclosure vulnerabilities. The combination of network accessibility, low attack complexity, and potential to leak sensitive data warrants timely remediation. The lack of active exploitation in the wild (KEV status: false) reduces immediate urgency but should not delay patching, as information disclosure vulnerabilities are attractive targets for sophisticated adversaries and can lead to secondary attacks.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is assigned based on: network accessibility (AV:N) requiring only a web page visit, low attack complexity (AC:L) with straightforward exploitation, no privileges required (PR:N), user interaction necessary (UI:R) to visit the malicious page, unchanged scope (S:U), and high confidentiality impact (C:H) through memory disclosure. No integrity or availability impact is scored, as the vulnerability reads data rather than modifying or denying service. The gap between Google's Low severity and CVSS Medium reflects the broader context of cross-platform impact and information sensitivity.

Frequently asked questions