CVE-2026-14391: Chrome ANGLE Integer Overflow Memory Disclosure on Windows

Technical summary

CVE-2026-14391 is an integer overflow (CWE-190) in ANGLE within the Chrome rendering engine on Windows. The vulnerability allows an attacker with pre-existing renderer process compromise to trigger memory disclosure through a specially crafted HTML page. The attack chain requires prior code execution in the renderer sandbox and relies on user interaction (UI:R). The integer overflow condition leads to out-of-bounds memory access (CWE-472), enabling information disclosure from process memory. The vulnerability is patched in Chrome 150.0.7871.46 and later.

Business impact

Organizations relying on Chrome as a primary browser should prioritize updating affected Windows systems, particularly for staff handling sensitive data. The vulnerability's real-world impact depends on whether renderer-process exploitation vectors are already prevalent in your threat landscape. For most enterprises, this is a medium-priority patch due to the multi-stage attack requirement, but users in high-value targeting scenarios should move faster. The information disclosure risk means credential theft, session tokens, or other sensitive data in process memory could be exfiltrated if the renderer is compromised through other means.

Affected systems

Google Chrome on Microsoft Windows versions prior to 150.0.7871.46 are affected. This includes all stable, extended stable, and beta releases below that version number. The vulnerability does not affect Chrome on macOS, Linux, Android, or iOS. Verify your organization's Chrome version distribution using your endpoint management tools to quantify exposure.

Exploitability

Exploitation is not trivial. An attacker must first compromise the Chrome renderer process through a separate vulnerability or attack vector, then serve a specially crafted HTML page to a user who visits the attacker-controlled site or receives a malicious link. The combination of required preconditions (renderer compromise + user interaction + specific HTML payload) limits opportunistic mass exploitation. No in-the-wild active exploitation has been reported at publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating it has not yet been observed being weaponized.

Remediation

Update Google Chrome to version 150.0.7871.46 or later on all affected Windows systems. Chrome's auto-update mechanism should deploy the patch, but verify completion on critical systems. For managed deployments, push the update through your endpoint management platform and confirm adoption across your fleet within your standard patching SLA. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 150.0.7871.46 or later across all Windows endpoints. Most users will receive the update automatically; force a restart of Chrome to ensure the new version is loaded. In enterprise environments, use group policy or mobile device management to enforce the update. Verify patch application by checking chrome://version in the address bar on a sample of machines to confirm the version number reflects 150.0.7871.46 or higher. Prioritize systems used by staff who handle high-value data or frequently visit untrusted websites.

Detection guidance

Monitor for Chrome version numbers below 150.0.7871.46 in your endpoint inventory and log aggregation systems. Alert on process crashes or unusual memory access patterns in chrome.exe if you have EDR/behavioral monitoring in place. Look for HTTP requests to malicious or suspicious domains from Chrome processes, though this vulnerability requires an existing renderer compromise so detection of the trigger page alone may not indicate active exploitation. Consider user awareness training to reduce the likelihood of users visiting attacker-controlled sites that could deliver the exploit payload.

Why prioritize this

Although the CVSS score is 5.3 (Medium), this vulnerability deserves attention because memory disclosure in the renderer process could expose high-value secrets depending on the user's browsing context and cached data. The attack requires renderer-level compromise, which is a real threat given other potential Chrome vulnerabilities and social engineering. Unlike denial-of-service flaws, this enables data exfiltration. Prioritize systems and users in your organization who are likely targets for sophisticated attackers or who regularly handle sensitive information.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the moderate attack complexity (difficult to exploit without prior compromise), high confidentiality impact (memory disclosure), and lack of integrity or availability impact. The network attack vector and required user interaction are captured in the vector string (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). The score appropriately penalizes the precondition of renderer compromise, which significantly reduces the real-world risk compared to a direct renderer escape. Organizations should not dismiss this as low-priority purely based on the score; context matters.

Frequently asked questions