CVE-2026-14384: Chrome ANGLE Out-of-Bounds Read Allows Cross-Origin Data Leak on Windows

Technical summary

CVE-2026-14384 is an out-of-bounds read vulnerability in the ANGLE graphics abstraction layer within Google Chrome on Windows. ANGLE translates WebGL and other graphics API calls to Direct3D on Windows systems. The flaw permits an attacker to craft HTML content that triggers an out-of-bounds memory read, bypassing the same-origin policy and exfiltrating cross-origin data. The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory access violation that can expose adjacent memory contents to a malicious script running in the browser context.

Business impact

Organizations with Windows-based workforces face data exfiltration risk if employees visit attacker-controlled websites while logged into sensitive web applications. Cross-origin data leakage could expose authentication tokens, session identifiers, or confidential information displayed in other browser tabs. Affected users include any Chrome user on Windows; the impact scales with the sensitivity of data typically accessed in browsers (email, cloud storage, SaaS applications). Financial services, healthcare, and government agencies using Chrome for web-based tools face elevated risk.

Affected systems

Google Chrome versions prior to 150.0.7871.46 on Microsoft Windows are affected. This includes all older Chrome releases on Windows systems regardless of build variant (stable, extended support, etc.). Macintosh, Linux, ChromeOS, and Android implementations of Chrome are not impacted by this specific flaw. Windows systems running patched Chrome 150.0.7871.46 or later are protected.

Exploitability

Exploitation requires a user to visit or be redirected to a malicious webpage; the attacker has no need for authentication, special network position, or local system access. The attack complexity is low—the malicious HTML does not depend on timing, race conditions, or system-specific memory layouts. However, user interaction is mandatory; the attack cannot be triggered silently or automatically without user awareness. Real-world exploitation likelihood is elevated due to the prevalence of web-based social engineering and the difficulty users face in distinguishing legitimate from malicious pages.

Remediation

Update Google Chrome to version 150.0.7871.46 or later on all Windows systems. Organizations should enable automatic Chrome updates where feasible or push patches through device management platforms. For users on managed devices, IT teams can enforce the minimum version via Group Policy (Windows domain environments) or Mobile Device Management solutions. End users can manually update via Chrome Menu > Help > About Google Chrome, which triggers automatic update if a newer version is available.

Patch guidance

Chrome automatically updates to patched versions upon restart. Administrators managing Windows devices should verify deployment to version 150.0.7871.46 or later using Chrome Enterprise policy (cloud or on-premises management). Test the update in a non-production environment first to confirm no compatibility issues with internal web applications. For organizations with extended update cycles, expedite patching—this is a network-reachable vulnerability requiring only user interaction, not local access.

Detection guidance

Monitor browser telemetry for anomalous memory access patterns or graphics API errors in Chrome crash reports (if telemetry is enabled). Check Windows Event Viewer for application crashes or errors associated with chrome.exe, particularly those mentioning graphics or ANGLE. Network detection is challenging because the payload is embedded in legitimate HTML; focus detection efforts on threat intelligence feeds noting active exploitation campaigns. Endpoint Detection and Response (EDR) tools may flag suspicious data exfiltration patterns if scripts attempt to encode and send memory contents to external servers.

Why prioritize this

Although the CVSS score is moderate (6.5), this vulnerability merits rapid patching because it enables cross-origin data theft—a critical confidentiality breach—through a low-friction user interaction on a ubiquitous application. The vulnerability affects Windows systems across all sectors and is internet-reachable, meaning it can be exploited at scale without special infrastructure. Organizations hosting sensitive web applications should prioritize patch deployment to all user devices within 2–4 weeks.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects the confluence of network reachability (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and mandatory user interaction (UI:R). The impact is high confidentiality loss (C:H) with no integrity or availability impact (I:N, A:N). The score appropriately captures the breach-of-confidence threat while acknowledging that successful exploitation depends on social engineering or user navigation to attacker-controlled content.

Frequently asked questions