CVE-2026-14147: Chrome UXSS via CSS Parsing Flaw – Patch Guide

Technical summary

CVE-2026-14147 stems from improper CSS implementation in Chrome's rendering engine that fails to properly isolate script and HTML content contexts. An attacker can craft a malicious HTML page that, when visited by a user, executes arbitrary JavaScript in the context of other websites or the browser itself. This is classified as a Uncontrolled XSS (UXSS) vulnerability—a critical category because the injection bypasses the same-origin policy that normally prevents cross-site attacks. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web injection flaw. The attack vector is network-based, requires no special privileges, but does require user interaction. The impact includes confidentiality and integrity compromise (reading/modifying page content) but not availability.

Business impact

Organizations should assess exposure based on employee browsing habits and the sensitivity of internal systems accessed via Chrome. While an attacker cannot directly steal credentials through this vulnerability alone, they could modify banking portals, inject phishing content, or harvest data from SaaS applications. For companies with strict browser policies, impact is limited; for others, user education and timely patching are critical. The requirement for user interaction means this is not a vector for mass, unattended compromise, but targeted attacks against specific users (executives, developers) remain viable. Delayed patching extends the window for opportunistic exploitation.

Affected systems

Google Chrome on all platforms (Windows, macOS, Linux, Android, iOS) prior to version 150.0.7871.47 is affected. Organizations should verify the specific version deployed in their environments; Chrome's auto-update mechanisms mean many users may already be running a patched version, but managed deployments or older builds may lag. Edge on Chromium, Opera, and other Chromium-based browsers may also be affected depending on their release cycle; verify against vendor advisories for those products.

Exploitability

Exploitation is relatively straightforward and does not require sophisticated techniques. An attacker needs only to host a malicious HTML page and trick a user into visiting it—via email link, advertisement, social engineering, or compromised website. No zero-click vector exists; user action (clicking/visiting) is mandatory. Public proof-of-concept code is not yet widespread, but the low complexity and clear attack vector mean that exploitation risk rises as awareness spreads. This is not yet in the Known Exploited Vulnerabilities catalog, suggesting real-world exploitation remains limited at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's built-in auto-update feature should deliver the patch automatically on browser restart; users can manually check for updates via Settings > About Chrome. For managed environments, deploy via your standard patch management pipeline, ensuring endpoints apply the update within 48–72 hours. Verify successful patching by confirming version numbers across managed devices. No workarounds exist; updating is the only remediation.

Patch guidance

1. Enable automatic updates if not already active (Settings > About Chrome > auto-update toggle). 2. For enterprise deployments, use Google's Admin console or Mobile Device Management (MDM) to enforce updates to 150.0.7871.47 or later. 3. Test the patch in a non-production environment first if your workflow permits, though this is a minor CSS rendering fix with low regression risk. 4. Verify patch application across all endpoints within 72 hours; document completion for compliance reporting. 5. Monitor Chrome Release Notes (chromereleases.googleblog.com) for any follow-up updates.

Detection guidance

Detection at the network level is difficult because the attack leverages legitimate CSS parsing. Monitor for: (1) User complaints about unexpected page content or behavior in Chrome; (2) Unusual outbound connections from Chrome processes to unexpected domains; (3) In-browser developer console errors or warnings suggesting script injection. Client-side detection: enable Chrome's Security Checkup (myaccount.google.com/security-checkup) and Safe Browsing (enabled by default). If your organization monitors endpoint behavior, flag suspicious iframe injections or DOM modifications on trusted internal sites. Given the low real-world exploitation rate to date, focus detection efforts on post-patch verification rather than proactive hunting.

Why prioritize this

Although Chromium designated this as low severity and CVSS is 6.1 (MEDIUM), prioritize patching within 3–5 business days because: (1) UXSS vulnerabilities are inherently dangerous due to their cross-site nature; (2) ease of exploitation via simple crafted HTML means opportunistic attackers will attempt it; (3) impact on confidentiality and integrity of sensitive web applications is tangible; (4) user interaction requirement limits blast radius but not targeted attack potential. This is not a critical emergency, but it warrants faster attention than routine security updates.

Risk score, explained

CVSS 6.1 (MEDIUM) reflects the network attack vector, low complexity, requirement for user interaction, and ability to affect confidentiality and integrity while preserving availability. The score appropriately captures the practical risk: easier to exploit than a logic flaw in a less-visited component, but less severe than a remote code execution or privilege escalation. The cross-site nature and browser context elevate concern beyond the base score; organizations should treat this as higher priority than the numerical MEDIUM rating alone suggests.

Frequently asked questions