CVE-2026-14408: Chrome Memory Leak via Dawn Graphics Flaw—CVSS 6.5 Medium

Technical summary

CVE-2026-14408 is an uninitialized memory use vulnerability (CWE-457) in Dawn, Google's cross-platform graphics API abstraction layer used by Chrome. When Dawn processes specially crafted HTML content, it may reference memory regions that have not been properly initialized, allowing attackers to leak sensitive information resident in the Chrome process's memory space. The vulnerability has a CVSS 3.1 score of 6.5 (MEDIUM) with a network attack vector, low complexity, no privilege requirements, and user interaction necessary. Impact is limited to confidentiality; there is no integrity or availability impact.

Business impact

Organizations with users on vulnerable Chrome versions face data exfiltration risk. An attacker can craft a webpage that, when visited, reads fragments of process memory—potentially including cached credentials, tokens, or other sensitive data from the user's Chrome instance. This exposure compounds if users browse untrusted sites or click malicious links. The requirement for user interaction significantly reduces the automatic infection risk but increases the need for user awareness and prompt patching.

Affected systems

The vulnerability affects Google Chrome versions prior to 150.0.7871.46. All platforms running affected Chrome versions are in scope: Windows, macOS, and Linux. Users on earlier versions, including extended support releases, should verify their specific Chrome version and update status against Google's official release notes.

Exploitability

The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed widespread active exploitation in the wild at this time. However, the attack requires only a standard network connection and user interaction (visiting a webpage), making it exploitable by remote attackers. No special tools, authentication, or elevated privileges are required from the attacker's perspective. The barrier to weaponization is moderate—an attacker must craft malicious HTML and host or distribute it, but the underlying flaw is deterministic.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. Chrome's auto-update mechanism should deploy the patch automatically, but users can manually verify their version (Menu > Help > About Google Chrome) and force an immediate update if needed. Organizations managing Chrome via enterprise policies should verify patch deployment status in their fleet and consider enabling automatic updates if not already active.

Patch guidance

Google Chrome users should update to 150.0.7871.46 or later. Verify your current version at chrome://version. For enterprise users: confirm patch deployment through your MDM solution or Chrome policy reporting dashboard. If auto-updates are disabled, manually push the update or enable auto-update functionality. No legacy or ESR-specific patch versions are documented for this CVE; standard Chrome stable channel updates apply. Verify successful patching by confirming the browser version after update and restart.

Detection guidance

Monitor browser crash logs and memory error reports for instances related to Dawn initialization failures. Network and endpoint teams should watch for users visiting suspicious or newly-registered domains that might host exploits. Browser telemetry (if enabled) may flag pages triggering memory access violations. Incident responders should inspect browsing history and temporary Chrome cache on systems potentially exposed to malicious pages. No specific IDS/IPS signatures are publicly available; detection is primarily reactive via browser behavior and user reports.

Why prioritize this

Assign medium priority. While the CVSS score is 6.5 (MEDIUM) and the vulnerability is not actively exploited in the wild per KEV data, the attack surface is broad (any webpage can trigger it), the barrier to exploitation is low, and Chrome is nearly ubiquitous in enterprise and consumer environments. The confidentiality impact is real but non-destructive. Prioritize patching for users in sensitive roles (finance, legal, research) and systems handling high-value data before general rollout, but treat the overall timeline as urgent rather than critical.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) Network attack vector—anyone on the internet can craft and serve malicious content; (2) Low attack complexity—no special conditions required; (3) No privilege requirement; (4) User interaction needed—must visit or interact with the page; (5) High confidentiality impact—memory disclosure; (6) No integrity or availability impact. The score lands in MEDIUM because memory leaks, while serious, are typically lower-severity than code execution or system compromise, yet the user-interaction requirement prevents a HIGH rating.

Frequently asked questions