CVE-2026-14396: Out-of-Bounds Read in Chrome ANGLE Library Allows Cross-Origin Data Leak

Technical summary

CVE-2026-14396 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer underlying Google Chrome's rendering pipeline. The flaw resides in memory access bounds checking during graphics processing. When a specially crafted HTML page is loaded, it can trigger an out-of-bounds memory access in ANGLE's code path, allowing an attacker to read memory contents beyond the intended buffer boundaries. Since ANGLE processes rendering instructions from web content, this can leak data associated with other origins or sensitive browser memory regions. The vulnerability is classified as CWE-125 (Out-of-bounds Read), a common memory safety issue in C/C++ applications. The Chromium security team assessed this as High severity due to the confidentiality impact.

Business impact

Information disclosure of this nature could expose sensitive user data, session tokens, authentication credentials, or other confidential information that a browser maintains in memory. For organizations whose employees browse sensitive internal or external sites, this vulnerability creates a cross-site data leakage risk. Attackers need only trick a user into visiting a malicious website—no advanced social engineering or multi-stage attacks are required. The impact extends beyond individual users to any organization relying on Chrome for browsing internal web applications or accessing sensitive cloud services. Data breaches resulting from cross-origin leaks can trigger regulatory notifications, reputational harm, and incident response costs.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are vulnerable. This includes all stable, beta, and development channel releases with version numbers below 150.0.7871.46. Organizations using Chrome for kiosk mode, enterprise deployments, or general browsing should assume their deployed instances are affected unless they have manually updated to or beyond the patched version. Chromebooks and Chrome OS devices running Chrome prior to version 150.0.7871.46 are also in scope.

Exploitability

The vulnerability has a moderate exploitability profile. An attacker must craft a malicious HTML page and convince a user to visit it—this is the user interaction (UI) requirement reflected in the CVSS vector. No special network position, authentication, or local access is needed; the attack is entirely remote and can be delivered via compromised websites, malicious advertisements, watering hole attacks, or phishing links. The barrier to exploitation is relatively low from a technical standpoint: once the HTML is crafted, it executes automatically when the page loads. However, the attack is not wormable or self-propagating, and it does require the user to visit a specific URL. Currently, this vulnerability is not tracked in the CISA KEV catalog, suggesting no active in-the-wild exploitation has been publicly disclosed or verified by the time of this analysis.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. Chrome's auto-update mechanism will deliver this patch automatically for most users, but organizations with managed deployments or disabled auto-updates must manually initiate the update process. System administrators should verify that Chrome policies are configured to allow or enforce timely updates. After patching, users can verify their Chrome version by navigating to chrome://version or checking Settings > About Chrome.

Patch guidance

Google Chrome will automatically update to patched versions on most systems when users restart the browser. Enterprise customers using Chrome for Business should consult https://chromereleases.googleblog.com/ for the official release notes for version 150.0.7871.46 and verify patch deployment in their environment. Organizations using tools like Google Admin Console can track update status across managed devices. Verify the applied version via chrome://version to confirm the patch is installed. If auto-update is disabled in your environment, enable it or manually download the latest stable release from google.com/chrome. Test critical internal web applications after patching to ensure compatibility, though this is typically not an issue for security updates.

Detection guidance

Network-based detection is difficult for this vulnerability since the attack relies on user-initiated visits to malicious web content. However, security teams can monitor for exploitation attempts indirectly: (1) Observe for users reporting unusual data leaks or unauthorized cross-site access; (2) Monitor for HTTP traffic to known malicious domains or suspicious newly registered domains bundling exploit kits; (3) Use endpoint detection and response (EDR) tools to identify Chrome child processes accessing sensitive memory regions in unexpected patterns, though this is difficult and requires tuned detection rules; (4) Enforce browser isolation or managed browsing solutions to limit exposure to untrusted websites. Internal web application security testing should include validation that sensitive data is not leaked through graphics rendering pipelines. Consider browser security benchmarking to validate that deployed Chrome versions are patched.

Why prioritize this

This vulnerability merits prioritization despite its MEDIUM CVSS score for several reasons: (1) the confidentiality impact is HIGH—sensitive cross-origin data can be leaked, a fundamental browser security boundary violation; (2) exploitability is straightforward and requires only user interaction, not a complex attack chain; (3) the ANGLE library is core to Chrome's rendering, affecting all rendering operations; (4) the attack surface is wide because any webpage can trigger it; (5) the data accessed could include authentication tokens, credentials, or personally identifiable information with downstream impact on user and organizational security. Organizations should patch within 48–72 hours of testing, with critical user-facing systems prioritized first.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects a high confidentiality impact (C:H) with no integrity or availability impact, and a remote attack vector requiring only user interaction on a non-isolated scope. While CVSS captures technical severity, the business context elevates this risk: cross-origin data leaks undermine the same-origin policy, a core browser security model. The MEDIUM rating may understate organizational risk if affected users routinely access sensitive web applications or services with high-value data. The lack of active exploitation (KEV status: false) slightly moderates urgency but does not eliminate it, as proof-of-concept code will likely emerge post-patch, making proactive patching essential.

Frequently asked questions