CVE-2026-14418: Chrome ANGLE Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-14418 involves an uninitialized use vulnerability (CWE-457) in ANGLE, the Almost Native Graphics Layer Engine used by Chrome for graphics rendering. When ANGLE processes certain graphics operations with uninitialized memory state, sensitive data from other origins can leak into the rendering context accessible to malicious JavaScript. The vulnerability is triggered via crafted HTML that manipulates graphics state, allowing cross-origin data exfiltration without modifying or denying service to target systems. The flaw affects Chrome versions before 150.0.7871.46.

Business impact

Cross-origin data leakage poses a significant privacy and compliance risk. Affected users could have session data, authentication tokens, or sensitive page content from other websites exposed to attacker-controlled scripts. This is particularly concerning for organizations where employees access internal tools or sensitive SaaS platforms in the same browser session as untrusted content. Regulatory implications vary by jurisdiction but could involve breach notification obligations depending on the nature and volume of exposed data.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are affected. The vulnerability is specific to Chrome and does not affect other Chromium-based browsers unless they also bundle the vulnerable ANGLE version. Desktop and mobile Chrome instances running unpatched versions are in scope.

Exploitability

Exploitation requires a remote attacker to craft a malicious HTML page and trick a user into visiting it—a common attack vector. No complex exploit chain, authentication, or user interaction beyond navigation is needed. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R configuration reflects network-accessible, low-complexity attack with user interaction (visiting the page). The vulnerability is not on CISA's Known Exploited Vulnerabilities list, indicating no publicly confirmed active exploitation at time of publication.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. Chrome's automatic update mechanism typically deploys security patches within days. Organizations managing Chrome deployments should prioritize rollout of this version to minimize exposure window. For users, checking Settings > About > Google Chrome will trigger update check if one is available.

Patch guidance

Google Chrome 150.0.7871.46 or later contains the fix. Verify the version in chrome://version/. Organizations using Chrome enterprise policies should update their deployment channels. Mobile versions of Chrome (Android and iOS) receive the same patch in their corresponding release cycle. Consider testing in a limited environment first if you manage extensive Chrome deployments, though security patches are typically safe to deploy broadly.

Detection guidance

Monitor for Chrome version compliance across endpoints using Mobile Device Management (MDM) or endpoint detection tools. Network-based detection is difficult since the attack occurs within legitimate HTTPS traffic to benign sites. Focus detection efforts on identifying systems running Chrome <150.0.7871.46. Log any anomalous graphics-related crashes or rendering errors that might indicate exploitation attempts, though these will be rare signals. Organizations should enforce auto-update policies to prevent version drift.

Why prioritize this

While the CVSS score is moderate at 4.3, this vulnerability merits timely attention due to: (1) the privacy-invasive nature of cross-origin data leakage; (2) the low barrier to exploitation (user must only visit a page); (3) widespread Chrome usage in corporate and consumer environments; (4) lack of workarounds short of disabling graphics acceleration, which degrades performance. The gap between Chromium's High severity rating and the CVSS 4.3 reflects that CVSS may underweight privacy breaches compared to availability or integrity impacts.

Risk score, explained

CVSS 3.1 score of 4.3 (Medium) reflects: Network attack surface (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction required (UI:R), and confidentiality impact limited to the victim's own cross-origin data leakage (C:L with unchanged scope). The score does not amplify for the systemic privacy implications of browsers as trust boundaries, nor does it account for the aggregated risk across millions of Chrome users. Organizations should layer business context—particularly if employees access sensitive web applications—when prioritizing patch deployment.

Frequently asked questions