CVE-2026-14146: Google Chrome CSS Cross-Origin Data Leak Vulnerability

Technical summary

This vulnerability stems from an inappropriate implementation in Chrome's CSS handling mechanism that fails to properly enforce cross-origin isolation boundaries. An attacker can craft a malicious HTML page that, when visited by a user, exploits the CSS processing logic to exfiltrate data from other origins the user has authenticated to or has open in other tabs. The flaw is categorized under CWE-200 (Information Exposure), indicating a failure in the access control or data segregation layer. The attack surface is the HTML/CSS parsing and rendering pipeline; no network-level attacks or privilege escalation are required. Exploitation depends on user interaction—specifically navigating to or being redirected to the attacker's HTML page—but requires no special configuration or user behavior beyond normal browsing.

Business impact

Data leakage across websites poses a direct confidentiality risk to enterprises and users. Employees may inadvertently expose authentication tokens, session cookies, or sensitive information displayed on one site while simultaneously visiting an attacker-controlled page. For organizations with multi-tab workflows (research, analysis, secure portals), the risk is amplified. Financially, this could lead to account compromise, credential theft, or exposure of proprietary information. The attack is silent—users will not receive a warning that their cross-origin data is being harvested—making detection without monitoring difficult.

Affected systems

Google Chrome releases prior to version 150.0.7871.47 are affected. This includes all earlier stable, beta, and extended release branches of Chrome. Organizations using Chrome as their primary browser, or allowing it alongside corporate browsers, should prioritize updates. The vulnerability affects Chrome on all supported platforms (Windows, macOS, Linux, Android, iOS), though the practical risk varies by deployment scenario.

Exploitability

Exploitability is straightforward for an attacker with basic web development skills. A crafted HTML page using CSS tricks to trigger the vulnerability requires no sophisticated techniques, zero-day knowledge, or user-level vulnerabilities in other software. The primary barrier to exploitation is user interaction—the victim must navigate to or be sent to the attacker's page. This could happen via phishing, social engineering, malicious advertisements, or compromised websites. Once a user visits, the attack executes automatically without additional prompts or suspicious behavior that would alert the user. No exploit code is publicly available yet, but the low technical bar suggests exploitation could accelerate once details become widely known.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update mechanism typically deploys patches within days of release; verify that automatic updates are enabled in your environment. For managed deployments, push the update through your device management platform (Intune, MDM, etc.) to ensure compliance. Users on older Chrome versions should manually check Settings > About Chrome if automatic updates have not applied the patch. No workarounds are available; patching is the only mitigation.

Patch guidance

Chrome 150.0.7871.47 and later contain the fix. Verify the version by navigating to chrome://version in the address bar. For enterprise deployments: (1) confirm auto-update policies are enabled via group policy or MDM; (2) if using extended support channels, consult Chrome's release notes to confirm the patch is included in your branch; (3) test the patch in a staging environment before full rollout if your organization has critical web-based applications; (4) consider forcing updates if auto-update has delays. Minor version skips are safe—any version 150.0.7871.47 or higher eliminates the vulnerability.

Detection guidance

Detection is challenging because exploitation leaves minimal forensic traces. Monitor for: (1) unusual tab activity or rapid tab creation/closure in security logs if available; (2) network traffic anomalies to attacker domains if users visit phishing sites; (3) Chrome browser logs (if centrally collected) for CSS rendering errors or warnings; (4) user reports of suspicious website behavior or unexpected data access. Deploy web filtering and DNS monitoring to block known malicious domains used in CSS-based data exfiltration campaigns. Educate users to avoid clicking untrusted links and to be cautious of websites requesting access to sensitive information.

Why prioritize this

Although Chromium rated this Low internally, the CVSS 6.5 MEDIUM score reflects the real-world risk: (1) high attack complexity is low—no special setup needed; (2) user interaction is required but is highly probable in normal browsing; (3) confidentiality impact is high—attackers can leak sensitive cross-origin data; (4) the attack is silent and difficult to detect post-exploitation. For organizations with users who work with multiple web applications simultaneously or handle sensitive data in browsers, this poses elevated risk compared to purely local or network-layer vulnerabilities. Prioritize patching within 1–2 weeks.

Risk score, explained

The CVSS 6.5 (MEDIUM) score reflects: AV:N (network-accessible), AC:L (low attack complexity—no special tools or configuration), PR:N (no privileges required), UI:R (user interaction required—the victim must visit the page), S:U (scope unchanged), C:H (high confidentiality impact—data leakage), I:N (integrity not affected), A:N (availability not affected). The score appropriately elevates the risk above Chromium's internal Low rating because it accounts for the real-world likelihood of users visiting untrusted content and the significant confidentiality breach possible through cross-origin data extraction. An organization's risk tolerance should factor in the frequency of browser-based work and the sensitivity of data accessed through web applications.

Frequently asked questions