CVE-2026-13914: Google Chrome Information Disclosure Flaw

CVE-2026-13914 Overview

CVE-2026-13914 is an information disclosure vulnerability affecting Google Chrome on macOS prior to version 150.0.7871.47. The flaw resides in the Passwords component and stems from an inappropriate implementation categorized under [CWE-284] Improper Access Control. A local attacker can leverage a malicious file to read potentially sensitive information from Chrome's process memory. Google classifies the Chromium security severity as Medium, and exploitation requires user interaction to open the malicious file. No public exploit or in-the-wild activity has been reported.

Critical Impact
Local attackers can extract sensitive data, including potentially stored password material, from Google Chrome process memory on macOS through a crafted file.

Affected Products

Google Chrome on macOS prior to 150.0.7871.47
Apple macOS (host platform)
Chrome Passwords component

Discovery Timeline

2026-06-30 - CVE-2026-13914 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database
2026-07-02 - EPSS score published at 0.113%

Technical Details for CVE-2026-13914

Vulnerability Analysis

The vulnerability affects the Passwords subsystem in Chrome on macOS. Chrome integrates with the operating system to manage saved credentials, and the flawed implementation exposes memory contents to unauthorized read operations when a specifically crafted file is processed. The attack vector is local, meaning the attacker must have some access to the target host or must induce a user to open a malicious file. Confidentiality impact is high because process memory may contain credentials, session tokens, and other secrets. Integrity and availability are not affected. The vulnerability is tracked under Chromium issue 508273690 and was fixed in the stable channel update that shipped Chrome 150.0.7871.47.

Root Cause

The root cause is an inappropriate implementation in the Passwords component that fails to properly restrict access to memory regions containing sensitive material. Under [CWE-284], the code does not enforce adequate access boundaries between untrusted file inputs and privileged password-handling memory. When Chrome parses a malicious file, the flawed logic permits attacker-controlled operations to disclose memory contents that should remain isolated. Refer to the Chromium Issue #508273690 for the tracked defect.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a malicious file to the victim, for example through a download, email attachment, or shared filesystem location. When the file is opened by Chrome or processed through the Passwords workflow, the attacker recovers fragments of Chrome's process memory. The disclosed data may include cached credentials, form fields, or other authentication artifacts. No network access to the browser is required, and no elevated privileges are needed by the attacker beyond the ability to place a file within reach of the victim.

No verified public exploit code exists for CVE-2026-13914. See the Google Chrome Stable Update advisory for release details.

Detection Methods for CVE-2026-13914

Indicators of Compromise

Presence of Chrome versions on macOS below 150.0.7871.47 in asset inventories.
Unexpected file downloads followed by Chrome process anomalies such as unusual memory access patterns or crashes.
Suspicious files with atypical extensions or MIME types opened via Chrome on macOS endpoints.

Detection Strategies

Inventory Chrome versions across macOS fleets and flag any host running a build below 150.0.7871.47.
Correlate file-open events in Chrome with subsequent access to the Chrome password store on disk (~/Library/Application Support/Google/Chrome/Default/Login Data).
Monitor for macOS Keychain access requests initiated by Chrome outside of normal user credential workflows.

Monitoring Recommendations

Enable endpoint telemetry for browser process behavior, focusing on file parsing and inter-process memory access.
Log Chrome auto-update status to confirm timely delivery of the 150.0.7871.47 patch.
Alert on Chrome child process crashes on macOS, which may indicate probing of the Passwords component.

How to Mitigate CVE-2026-13914

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 150.0.7871.47 or later.
Verify auto-update is enabled and functioning by checking chrome://settings/help on managed devices.
Restrict execution of files from untrusted sources and enforce macOS Gatekeeper policies.

Patch Information

Google released the fix in the Chrome Stable channel update at version 150.0.7871.47 for macOS. Administrators should deploy the update through Chrome's built-in updater or through enterprise management tooling. Full release notes are available in the Google Chrome Stable Update advisory, and the underlying defect is tracked in Chromium Issue #508273690.

Workarounds

Advise users to avoid opening files from untrusted sources in Chrome until the patch is applied.
Consider disabling Chrome's built-in password manager and using an external credential vault where operationally feasible.
Apply application allowlisting on macOS to limit which files Chrome will process on managed endpoints.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome to check for updates via command line
open -a "Google Chrome" --args --check-for-update-interval=1