CVE-2026-14003: Google Chrome Information Disclosure Flaw

CVE-2026-14003 Overview

CVE-2026-14003 is an insufficient policy enforcement flaw in the Extensions component of Google Chrome before version 150.0.7871.47. An attacker who convinces a user to install a malicious extension can leak cross-origin data through a crafted Chrome Extension. The issue is tracked under [CWE-284] (Improper Access Control) and Chromium rates it Medium severity. The vulnerability requires user interaction and does not enable code execution, but it undermines the same-origin boundary that browser extensions must respect.

Critical Impact
A malicious extension can bypass extension policy checks to read cross-origin data, exposing information from sites the user is authenticated to.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers that inherit the same extension policy code path
Desktop Chrome distributions on Windows, macOS, and Linux stable channel

Discovery Timeline

2026-06-30 - CVE-2026-14003 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14003

Vulnerability Analysis

The flaw resides in how Chrome enforces policy on extension APIs that mediate access to web content across origins. When an extension issues certain requests, the browser fails to apply the full set of cross-origin restrictions that would normally block reading data belonging to another site's origin. As a result, an extension with routine permissions can retrieve response data outside the origins it should be constrained to.

The attack requires user interaction because the victim must install the malicious extension, typically from a third-party source or a compromised listing. Once installed, the extension operates with the identity of the signed-in user and can silently exfiltrate data from any origin the browser can reach.

Root Cause

The root cause is improper access control [CWE-284] in the Extensions subsystem. Policy checks that should gate cross-origin data flows through extension APIs are incomplete, letting a crafted extension observe responses that should remain isolated to their originating context. See the Chromium Issue Tracker Entry for the upstream discussion.

Attack Vector

Exploitation follows a social engineering path. The attacker publishes or sideloads a Chrome Extension carrying manifest declarations that appear benign. After installation, the extension issues requests through the affected extension APIs and receives cross-origin response bodies that the browser should have withheld. No zero-day memory corruption or sandbox escape is involved; the abuse is confined to the extension policy layer described in the Google Blog Chrome Update.

No public exploit or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-14003

Indicators of Compromise

Installation of Chrome Extensions from outside the official Chrome Web Store, especially those requesting broad host permissions such as <all_urls>.
Chrome process making outbound connections to attacker-controlled domains shortly after extension installation.
Unexpected entries in the Extensions and Preferences files under the Chrome user data directory.

Detection Strategies

Inventory installed extensions across managed endpoints and compare extension IDs against an approved allowlist.
Alert on Chrome versions below 150.0.7871.47 reporting into asset management or EDR telemetry.
Hunt for browser child processes initiating cross-origin fetches to low-reputation destinations after new extension installs.

Monitoring Recommendations

Forward Chrome extension install and update events to a central log platform for review.
Monitor DNS and proxy logs for beaconing patterns originating from browser processes.
Track Chrome update compliance and flag hosts that lag more than one stable channel release behind.

How to Mitigate CVE-2026-14003

Immediate Actions Required

Update Google Chrome to 150.0.7871.47 or later on all endpoints.
Audit installed extensions and remove any not sourced from the Chrome Web Store or an approved internal catalog.
Restrict extension installation through enterprise policy so only vetted extension IDs can be added.

Patch Information

Google fixed CVE-2026-14003 in the Chrome stable channel release 150.0.7871.47. Details are documented in the Google Blog Chrome Update. Managed environments should trigger Chrome's built-in updater or push the new package through existing software distribution tooling.

Workarounds

Set the ExtensionInstallBlocklist policy to * and use ExtensionInstallAllowlist to permit only reviewed extension IDs.
Use ExtensionInstallSources to constrain where users can install extensions from until patching is complete.
Communicate to users the risk of installing extensions from unofficial sources, especially those requesting broad host access.

bash

# Chrome enterprise policy example (Linux JSON policy file)
# /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ],
  "ExtensionInstallSources": [
    "https://chrome.google.com/webstore/*"
  ]
}