CVE-2026-14421: Chrome Memory Disclosure Flaw in Dawn Graphics Engine

Technical summary

CVE-2026-14421 is an uninitialized variable vulnerability in the Dawn graphics engine, a WebGPU implementation used by Google Chrome. The flaw occurs when the graphics library fails to properly initialize memory structures before use, leaving residual data from previous operations accessible to web content. A remote attacker can craft HTML that triggers rendering operations to read uninitialized memory regions, potentially extracting sensitive data resident in the process heap or GPU-accessible memory. The vulnerability is network-based and requires no special privileges, but does require user interaction to load the malicious page. CWE-457 (Use of Uninitialized Variable) is the root cause. Google rated this as Medium severity on the Chromium security scale.

Business impact

The primary risk is confidentiality breach: sensitive information stored in process memory may leak to attackers without the user's knowledge. For organizations relying on ChromeOS devices, this could expose corporate data, authentication credentials, or session information if users visit malicious sites. The attack vector is deceptive—users simply visit a webpage—making it difficult to prevent through technical controls alone. However, the impact is limited to information disclosure; business continuity and system integrity are not directly threatened. Organizations should prioritize patching systems that handle sensitive work or access privileged data.

Affected systems

Google Chrome and ChromeOS versions prior to 150.0.7871.46 are vulnerable. This includes all Chrome instances on ChromeOS before that release date, as well as Chrome browsers on other operating systems running earlier versions. Organizations should verify their current Chrome version and ChromeOS build numbers to assess exposure. Enterprise deployments with managed Chrome instances are easier to patch centrally, while personal devices may require user-initiated updates.

Exploitability

Exploitation is moderately straightforward but not trivial. An attacker must craft a specially designed HTML page that triggers specific rendering behavior in Dawn to read uninitialized memory. The attack requires users to visit the malicious site—either through phishing, malicious advertising, or compromised legitimate sites. There is no known public exploit code, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been reported. However, the network-accessible, user-interaction attack vector makes it an attractive target for opportunistic attackers.

Remediation

Update Chrome and ChromeOS to version 150.0.7871.46 or later. For ChromeOS devices, updates typically arrive through automatic system updates; users should check Settings > About ChromeOS to trigger an immediate check. For Chrome on other platforms, go to Settings > About Google Chrome to auto-update. Organizations using Chrome Enterprise should deploy the patched version through their managed update channels. No workarounds exist; patching is the only remediation.

Patch guidance

Prioritize patching for any ChromeOS device that handles sensitive data, customer information, or authentication credentials. Chrome on other operating systems should also be updated as a standard maintenance task. Verify the update reaches version 150.0.7871.46 or higher by checking Chrome > Settings > About Google Chrome (it will display the installed version). For enterprise customers, use Google Chrome Enterprise to push the update across your fleet. Test in a small pilot group first if your environment requires change control, though this is a security patch and should not introduce compatibility issues.

Detection guidance

Monitor for Chrome version compliance using endpoint detection and response (EDR) tools or mobile device management (MDM) solutions for ChromeOS. Check for the presence of version 150.0.7871.46 or later in your asset inventory. Network-based detection of exploitation is difficult since the attack occurs within the browser sandbox; focus detection efforts on user behavior anomalies (e.g., unexpected data exfiltration) rather than network signatures. Consider logging Chrome update events to ensure timely rollout in enterprise environments.

Why prioritize this

While rated CVSS 6.5 (Medium), this vulnerability warrants prompt attention because it enables information disclosure with minimal user friction. The uninitialized memory read can expose cryptographic material, session tokens, or personally identifiable information—assets that are harder to replace than system availability. The attack requires only network access and user interaction, making it feasible for broad campaigns. Organizations handling sensitive data on ChromeOS should treat this as high priority. General user devices can be patched on a normal maintenance cycle.

Risk score, explained

CVSS 6.5 reflects the combination of high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N), and a user-interaction requirement (UI:R) that reduces exploitability from a theoretical 7.5. The network attack vector (AV:N) and low attack complexity (AC:L) increase the score; the privilege requirement (PR:N) and scope constraint (S:U) keep it moderate. The score appropriately captures that data loss is possible but system compromise is not. Organizations should not interpret CVSS 6.5 as 'low risk'—information disclosure vulnerabilities are often underestimated but can have lasting consequences.

Frequently asked questions