CVE-2026-14399: Memory Disclosure in Chrome 150.0.7871.46 – Patch Now

Technical summary

CVE-2026-14399 is an uninitialized memory use vulnerability in the Dawn graphics abstraction layer, which Chrome uses to manage GPU rendering across platforms. The flaw allows remote code execution context to read uninitialized heap or stack memory by crafting a malicious HTML page that triggers specific graphics operations. The vulnerability is classified as CWE-457 (Use of Uninitialized Variable) and carries a CVSS 3.1 score of 6.5 (Medium). The attack vector is network-based with low complexity; the only barrier is user interaction (UI requirement), meaning a user must visit the attacker's page or click a link. There is no impact on system integrity or availability, only confidentiality.

Business impact

This vulnerability poses a moderate but real risk to organizations where employees browse untrusted content or receive phishing emails with malicious links. Depending on what data the browser has cached or is processing at the time of exploitation, an attacker could exfiltrate sensitive information such as authentication tokens, personal data from web applications, or snippets of other users' sessions if the device is shared. While the severity is medium and requires user interaction, the ease of delivery via email or watering-hole attacks makes this a practical threat in enterprise environments. Organizations relying on Chrome for sensitive work should treat this as a priority update.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are vulnerable across all platforms (Windows, macOS, Linux, Chrome OS, Android). Any user or system running an older version of Chrome is at risk if they visit a malicious webpage or click a crafted link. This includes both consumer users and enterprise deployments. Chrome's auto-update mechanism may have already deployed the fix to many users, but manual verification is necessary for locked-down or offline environments.

Exploitability

The vulnerability is straightforward to exploit from a technical perspective: an attacker simply hosts a malicious HTML page and tricks a user into visiting it. No authentication, special configuration, or zero-day tooling is required. The barrier to exploitation is low—the primary constraint is social engineering and user click-through. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not been publicly documented at the time of publication, but that does not guarantee absence of private or emerging exploits.

Remediation

Users and administrators must update Chrome to version 150.0.7871.46 or later. Google Chrome's auto-update feature should have deployed this patch automatically for most users; however, verify your version at chrome://version/. Enterprise users should deploy updates through their mobile device management (MDM) or configuration management tools. Organizations that cannot immediately update should consider restricting Chrome usage for high-risk activities or using Chrome with restricted site access policies until patches are applied.

Patch guidance

Update Chrome to version 150.0.7871.46 or later. Users can manually check for updates via Help > About Google Chrome; the browser will automatically download and prompt for restart. Enterprise administrators should verify patch deployment through their MDM console or by reviewing browser version reporting. For systems with auto-update disabled, manually trigger the update process. Test the patch in a non-production environment if possible before organization-wide rollout, though this is a straightforward security patch with low breaking-change risk.

Detection guidance

Endpoint detection and response (EDR) tools should monitor for signs of suspicious graphics rendering or memory access patterns, though this is difficult to detect behaviorally in real time. Network detection is more practical: look for traffic to known malicious sites that host pages exploiting this flaw, or monitor for anomalous memory read operations if your organization has application-level visibility. Browser version auditing is the most reliable detection method—scan your environment for Chrome versions older than 150.0.7871.46 using asset inventory or MDM tools. Check browser auto-update settings to ensure patches are being applied.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 6.5 and Medium severity, combined with the requirement for user interaction, place it in the 'patch this week' category rather than 'patch today.' However, the low complexity of exploitation and high likelihood of user click-through in a phishing campaign justify prioritizing it above lower-scoring vulnerabilities. Organizations with users in high-risk roles (finance, legal, executive) or those handling sensitive data should patch first.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the balance between ease of exploitation (network-accessible, low complexity) and limited impact (confidentiality only, no integrity or availability damage). The UI requirement and lack of privilege escalation keep the score from being higher. In practical terms, this is a medium-risk vulnerability that is easy to exploit but requires social engineering and results in information disclosure rather than code execution or system compromise. Organizational risk is elevated in phishing-heavy threat environments.

Frequently asked questions