CVE-2026-14149: Chrome Audio Use-After-Free Remote Code Execution on Linux

Technical summary

CVE-2026-14149 is a use-after-free (CWE-416) in Chrome's audio subsystem on Linux. The vulnerability allows remote code execution when a user visits a specially crafted webpage. The attack surface is the renderer process handling audio content; no authentication or elevated privileges are required. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, combined with network-based delivery and low attack complexity. Notably, Chromium project classified this as Low severity internally, indicating it may require specific audio codec configurations or user interaction patterns to reliably exploit in practice.

Business impact

Successful exploitation could allow attackers to compromise user workstations running Chrome on Linux, leading to data theft, credential harvesting, malware installation, or lateral movement within corporate networks. The requirement for user interaction (clicking a link or visiting a compromised site) makes this a credible phishing or watering-hole attack vector. Organizations with significant Linux desktop deployments or users accessing untrusted websites face elevated risk.

Affected systems

Google Chrome on Linux systems running versions prior to 150.0.7871.47. This affects both enterprise deployments and consumer Linux users. The Linux kernel itself is listed in the vendor/product database but the vulnerability is specific to Chrome's audio handling, not a kernel flaw.

Exploitability

The vulnerability requires user interaction—visiting a malicious webpage—but does not require convincing users to enable plugins, execute files, or grant unusual permissions. An attacker can host the exploit on a website and use phishing or compromised advertising to drive traffic. The low attack complexity and network-based delivery make it suitable for mass exploitation. However, the Chromium project's internal Low severity rating suggests real-world exploitation may depend on specific conditions (audio codecs, sandbox state, or timing).

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all Linux systems. Enable automatic updates to receive patches without manual intervention. For organizations, deploy updates via configuration management or endpoint management tools to enforce compliance. Test updates in a staging environment first, though this particular fix is not known to break common workflows.

Patch guidance

Verify that Chrome auto-updates are enabled in your environment. On Linux, check that the system package manager or Chrome's built-in updater has refreshed to version 150.0.7871.47 or later. Run 'google-chrome --version' or 'chromium-browser --version' to confirm. For enterprise, push version 150.0.7871.47 via your endpoint management system and confirm rollout within 48–72 hours of the patch release.

Detection guidance

Monitor Chrome crash logs and renderer process exits for abnormal terminations that may indicate exploitation attempts. Look for network traffic to known malicious domains or phishing campaigns referencing audio-heavy content. Intrusion detection systems may identify unusual memory patterns in Chrome processes if they support process-level inspection, though signature-based detection of use-after-free exploitation is difficult. Focus on behavioral indicators: users reporting browser crashes after visiting certain websites, or security events tied to the renderer sandbox.

Why prioritize this

Although Chromium classified this internally as Low severity, the CVSS 3.1 score of 8.8 reflects remote code execution with high impact and low barriers to entry. The requirement for user interaction slightly reduces urgency compared to wormable vulnerabilities, but the ease of delivery via web browsing makes this a realistic attack scenario. Prioritize patching for users in high-risk roles (finance, HR, legal) and environments handling sensitive data. Standard business users should receive patches within the normal update cycle.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) combines a network attack vector, low complexity, no privilege requirement, and user interaction with high confidentiality, integrity, and availability impact. This reflects the potential for arbitrary code execution on victim machines. The discrepancy with Chromium's internal Low rating may reflect that reliable exploitation in the wild requires specific audio conditions or particular user workflows; nevertheless, the theoretical impact warrants the HIGH rating and timely patching.

Frequently asked questions