CVE-2026-14422: Chrome Tint Out-of-Bounds Memory Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-14422 is an out-of-bounds memory access vulnerability affecting Chrome versions before 150.0.7871.46. The flaw resides in Tint, Chrome's rendering engine component, and encompasses both read (CWE-125) and write (CWE-787) operations outside allocated memory regions. An attacker can exploit this via a crafted HTML page delivered over the network. The vulnerability has a CVSS 3.1 score of 8.8 (High severity) with a vector indicating network accessibility, low attack complexity, no privilege requirement, and user interaction needed, but with full impact on confidentiality, integrity, and availability.

Business impact

Successful exploitation could allow attackers to steal sensitive user data (credentials, personal information, browsing history), modify content in transit, or crash the browser causing denial of service. For organizations where employees rely on Chrome for work, this increases risk of credential theft and data exfiltration. Given the prevalence of Chrome in enterprise and consumer environments, the attack surface is broad and the business impact considerable if users remain unpatched.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are affected. The vulnerability impacts Chrome across all supported platforms (Windows, macOS, Linux, Android, iOS) where the Tint component is used for rendering. Any user or organization running an unpatched version of Chrome is at risk when visiting untrusted websites or receiving phishing attacks with malicious HTML.

Exploitability

The vulnerability is readily exploitable in real-world attack scenarios. It requires only network access and user interaction (visiting a malicious site), both low barriers in typical browsing. No special authentication or elevated privileges are needed. The attack is as simple as hosting a malicious webpage or injecting malicious HTML into a legitimate site. The straightforward delivery mechanism and broad reachability make this a practical threat.

Remediation

Upgrade Google Chrome to version 150.0.7871.46 or later immediately. Chrome's auto-update mechanism should deploy the patch automatically, but users can manually verify they are on the fixed version by checking Settings > About Chrome. Organizations should verify patch deployment across their user base and consider restricting access to untrusted sites through security controls while updates are pending.

Patch guidance

Users should prioritize updating Chrome as soon as the fixed version becomes available in their region. Organizations running Chrome in managed environments should deploy version 150.0.7871.46 or later through their patch management systems. Test the update in a non-production environment first if feasible, though this vulnerability's severity warrants rapid deployment. Verify successful patching by checking the About Chrome page to confirm the version number has been updated.

Detection guidance

Monitor Chrome version numbers across your organization to identify systems still running versions before 150.0.7871.46. Endpoint detection and response (EDR) tools may flag unusual memory access patterns if exploitation is attempted, though out-of-bounds memory issues can be subtle. Network-level detection is limited since the attack vector is a crafted HTML page; focus on ensuring all instances of Chrome are updated and educating users about phishing and malicious link risks.

Why prioritize this

This vulnerability merits urgent attention due to its high CVSS score (8.8), exploitability with no authentication required, widespread Chrome usage, and the comprehensive impact (C, I, A all high). While it requires user interaction, that is a low barrier given the volume of web traffic and phishing campaigns. The lack of a KEV entry does not diminish its priority; organizations should patch proactively rather than waiting for active in-the-wild exploitation confirmation.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction needed (UI:R), and high impact across all three security properties (C:H, I:H, A:H). The 'High' severity designation underscores that successful exploitation can result in complete compromise of user confidentiality, integrity, and system availability. The user interaction requirement prevents a critical score but does not materially reduce real-world risk.

Frequently asked questions