CVE-2026-14388: Chrome ANGLE Out-of-Bounds Memory Read – Patch to 150.0.7871.46

Technical summary

An out-of-bounds read vulnerability exists in ANGLE (Almost Native Graphics Layer Engine), a graphics abstraction library used by Chromium. The flaw allows reading memory locations beyond allocated buffer boundaries without proper bounds checking. This occurs during HTML page processing. An attacker can craft a malicious HTML payload that, when rendered by an unpatched Chrome browser, triggers the out-of-bounds read to leak process memory. The CVSS 3.1 score of 6.5 (Medium) reflects high confidentiality impact but no integrity or availability compromise. The attack vector is network-based with low complexity and requires only user interaction, not authentication.

Business impact

This vulnerability threatens user data confidentiality across organizations where Chrome is the primary browser. Risk is particularly elevated for users accessing sensitive web applications, financial services, or internal tools from unpatched Chrome instances. Attackers may exfiltrate session tokens, authentication credentials, or sensitive cached data from memory. The medium severity classification means this is not an immediate service-disruption risk, but data loss or credential compromise could occur if exploitation occurs before patching. Organizations relying on Chrome for secure workflows should treat timely patching as a standard maintenance priority.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are affected. This includes all earlier stable, beta, and development releases of Chrome on Windows, macOS, Linux, Android, and iOS platforms. Verify your installed Chrome version via Settings > About Chrome; any version below 150.0.7871.46 requires patching. Enterprise Chrome deployments and Chrome-based Chromium distributions should also be evaluated for impact.

Exploitability

Exploitability is moderate and practical. The vulnerability is not listed on the KEV (Known Exploited Vulnerabilities) catalog, indicating no confirmed wild exploitation as of the publication date. However, the attack surface is large: any website a Chrome user visits could host the malicious HTML. The attack requires only a user clicking a link or visiting a compromised page—no additional social engineering or privilege escalation is needed. The out-of-bounds read may be triggered reliably with the right HTML/graphics payload, though successful memory exfiltration depends on memory layout and what data happens to reside at adjacent offsets.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. Chrome automatically checks for updates and applies them after restart in most configurations. For enterprise deployments, push updates via Active Directory, Mobile Device Management (MDM), or your browser management platform. Verify successful patching by checking Settings > About Chrome; it should report the current version. No workaround exists; patching is the only mitigation. Communicate the update to users and confirm deployment completion within your security baseline window.

Patch guidance

Google Chrome 150.0.7871.46 and later contain the fix. For most users, Chrome will auto-update; check About Chrome to force an update check if needed. Enterprise administrators should deploy via group policy (Windows), configuration profiles (macOS/iOS), or MDM for Android. Verify patch deployment completion using your endpoint telemetry or browser management tools. Consider prioritizing this update within 2–4 weeks of release to align with standard patch cycles, sooner if users handle highly sensitive data.

Detection guidance

Monitor Chrome version compliance across your endpoints using Mobile Device Management, endpoint detection and response (EDR) tools, or browser inventory solutions. Check for instances running versions before 150.0.7871.46. Network detection is limited since the attack occurs within the browser rendering engine; focus on deployment and version verification. If you suspect exploitation, examine Chrome process memory dumps or browser cache for anomalous artifacts, though post-exploitation forensics are difficult. Prioritize version auditing as the primary detection mechanism.

Why prioritize this

Although this is a Medium-severity vulnerability with no current wild exploitation, it warrants timely patching due to high confidentiality impact and low exploitation friction. Any user can be targeted by a malicious website, making the risk population-wide. Prioritization should reflect your organization's data sensitivity and Chrome usage patterns: financial services, healthcare, and government organizations should patch faster; general office environments can follow standard patch cycles. The lack of KEV status provides a narrow window before potential active exploitation.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) balances two factors: (1) High confidentiality impact—memory reads can leak sensitive data—and (2) No integrity or availability impact since the vulnerability cannot modify or crash systems. The network attack vector and low complexity reflect easy exploit delivery, but the requirement for user interaction (UI:R) reduces the score. The score does not factor in business context; organizations handling encryption keys or authentication credentials may view this as effectively higher risk despite the Medium label.

Frequently asked questions