CVE-2026-14002: Google Chrome XSS Vulnerability

CVE-2026-14002 Overview

CVE-2026-14002 is a user interface spoofing vulnerability in the Geolocation component of Google Chrome. The flaw affects all versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can exploit this issue via a crafted HTML page to spoof the browser's UI. Google classified the Chromium security severity as Medium. The weakness is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
Attackers can misrepresent geolocation prompts and other trusted browser UI elements to trick users into granting sensitive permissions or trusting malicious content.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers incorporating the vulnerable Geolocation implementation
Desktop Chrome Stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-14002 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14002

Vulnerability Analysis

The vulnerability resides in Chrome's Geolocation implementation. The component fails to properly enforce boundaries between renderer-controlled content and trusted browser UI surfaces. An attacker who has already gained code execution inside the renderer process can leverage this weakness to overlay or mimic legitimate geolocation-related UI. The attack relies on user interaction with a crafted HTML page. Because the spoofed elements appear inside the browser chrome, users cannot easily distinguish the fake prompt from a legitimate one. Successful exploitation targets the integrity of the user interface rather than confidentiality or availability. This makes it useful as a follow-on stage in multi-step attacks that combine a renderer compromise with social engineering.

Root Cause

The root cause is an inappropriate implementation of the Geolocation feature in the browser process boundary. Trusted UI decisions are influenced by data that a compromised renderer can control. This gives the renderer the ability to alter how permission prompts, origin indicators, or geolocation status are displayed. The design assumption that the renderer would only supply benign content is violated once the sandbox is subverted.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the renderer process, typically through a separate memory corruption or logic flaw. Second, the victim must load a crafted HTML page and interact with it. The attacker then manipulates the geolocation-related UI to mislead the user. The vulnerability is network reachable, requires no privileges, and is exploited through user interaction with the malicious page. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor context.

Detection Methods for CVE-2026-14002

Indicators of Compromise

Chrome installations running versions below 150.0.7871.47 in enterprise inventory scans
Browser telemetry showing renderer crashes or sandbox escapes preceding unusual permission grants
Web traffic to attacker-controlled pages that repeatedly invoke the navigator.geolocation API
User reports of geolocation prompts appearing without a corresponding site interaction

Detection Strategies

Inventory endpoints for Chrome versions and flag any build older than 150.0.7871.47
Correlate renderer process crashes with subsequent permission changes in Chrome preferences
Monitor for unexpected modifications to the Preferences file under the Chrome user profile that grant geolocation to unfamiliar origins
Hunt for HTML pages containing suspicious geolocation prompt overlays served from newly registered domains

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to correlate renderer exploitation with UI-triggered permission changes
Track Chrome auto-update status across managed fleets to confirm patched builds are deployed
Alert on process anomalies in chrome.exe child processes that deviate from baseline renderer behavior

How to Mitigate CVE-2026-14002

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force browser restart after the update to ensure the patched binaries are loaded
Audit granted geolocation permissions in Chrome and revoke entries for untrusted origins
Prioritize patching for users who handle sensitive location data or high-value accounts

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. Administrators should confirm that endpoints have received Chrome 150.0.7871.47 or a later build. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Disable the Geolocation API through enterprise policy where the feature is not required
Configure the DefaultGeolocationSetting policy to block geolocation prompts on unmanaged sites
Restrict browsing to allowlisted domains via web filtering to reduce exposure to crafted HTML pages
Educate users to reject unexpected geolocation prompts until patches are confirmed deployed

bash

# Configuration example: enforce Chrome policy to block geolocation by default
# Windows registry (HKLM)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultGeolocationSetting /t REG_DWORD /d 2 /f

# macOS managed preferences
defaults write com.google.Chrome DefaultGeolocationSetting -int 2

# Verify installed Chrome version meets the patched build
google-chrome --version