CVE-2026-14385: Heap Buffer Overflow in Chrome ANGLE (macOS)

Technical summary

CVE-2026-14385 is a heap buffer overflow in ANGLE (Almost Native Graphics Layer Engine), which handles GPU-accelerated graphics rendering in Chromium-based browsers. The vulnerability arises from improper bounds checking when writing to heap-allocated buffers, allowing an out-of-bounds memory write via specially crafted HTML content. The flaw maps to CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). Exploitation occurs at the network boundary; a victim visiting a malicious website triggers the overflow during page rendering without requiring the user to take additional action beyond visiting the site.

Business impact

Exploitation of this vulnerability could allow an attacker to achieve arbitrary code execution within the Chrome process context. Depending on browser sandbox effectiveness and the attacker's heap spray techniques, this could lead to complete compromise of user sessions, theft of credentials or stored data, execution of malware, or lateral movement within an organization if the compromised browser process has access to internal resources. Organizations with users on macOS who rely on Chrome for work or access to sensitive systems face material risk until patching is complete.

Affected systems

The vulnerability affects Google Chrome versions prior to 150.0.7871.46 running on Apple macOS. While ANGLE is used across multiple Chromium-based browsers, this advisory focuses on Chrome on Mac. Organizations should inventory Chrome deployments on macOS and determine version distributions to prioritize patching efforts. Systems running Chrome 150.0.7871.46 or later are not affected.

Exploitability

Exploitability is high. The attack vector is network-based (no VPN or network segmentation bypass required), attack complexity is low (the malicious HTML is straightforward to craft), and user interaction is limited to visiting a compromised or attacker-controlled website. There is no requirement for elevated privileges. Proof-of-concept code has not been observed in the wild as of the vulnerability's publication, but the technical nature of heap overflows makes weaponization straightforward for capable threat actors. The user experience barrier is minimal—a user simply needs to visit a malicious site.

Remediation

Immediate patching is the primary remediation. Users and administrators should update Google Chrome to version 150.0.7871.46 or later on all macOS systems. Chrome's auto-update mechanism should deploy patches within days, but administrators managing corporate Chrome instances should verify deployment and consider forcing updates for users who delay. No workarounds exist; disabling JavaScript or certain browser features will not prevent this vulnerability from being exploited via crafted HTML that triggers the graphics rendering path.

Patch guidance

Apply Chrome version 150.0.7871.46 or later as soon as possible. For managed deployments, verify the update has been pushed and monitor compliance. Users on personal systems should allow Chrome to auto-update or manually check Settings > About Chrome to trigger an update check immediately. Test any critical web applications after patching to confirm no regressions. For organizations unable to update immediately due to compatibility concerns, implement network controls such as blocking access to known malicious sites or restricting outbound connections from systems where possible, though these are temporary measures only.

Detection guidance

Detection is challenging at the network level because the exploit consists of benign-looking HTML and JavaScript triggering a rendering engine flaw. Organizations can monitor Chrome crash reports and diagnostics if enabled—successful exploitation often results in process crashes or exceptions. Endpoint detection systems should alert on suspicious Chrome process behavior including unexpected child processes, memory anomalies, or access to sensitive files. Threat intelligence feeds may identify malicious domains hosting exploit pages; block these via DNS filtering or web proxies where feasible. Prioritize patching over detection-based defense for this vulnerability.

Why prioritize this

This vulnerability rates HIGH priority for immediate patching. The CVSS score of 8.8 reflects high attack complexity, network-based exploitation, user interaction requirement, and potential for full compromise of the browser process. No active exploitation has been added to CISA's KEV catalog as of publication, but that should not delay patching—sophisticated threat actors often exploit untracked vulnerabilities before public disclosure is made. The attack surface is broad (any website visit), the barrier to user interaction is minimal, and the impact (code execution) is severe. This should be in your top-tier patch queue.

Risk score, explained

The CVSS v3.1 score of 8.8 (HIGH) reflects: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with impact to confidentiality, integrity, and availability all rated as high (C:H/I:H/A:H). The user interaction requirement prevents a perfect 9.8 score, but this is still a critical vulnerability. In context, the heap overflow's potential for remote code execution and the minimal user effort required to trigger it justify treating this as a high-priority patch despite the UI:R constraint.

Frequently asked questions