CVE-2026-14019: Google Chrome Information Disclosure Flaw

CVE-2026-14019 Overview

CVE-2026-14019 is an inappropriate implementation flaw in the Passwords component of Google Chrome. Versions prior to 150.0.7871.47 are affected. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. The issue is classified under CWE-522: Insufficiently Protected Credentials. Chromium rates the security severity as Medium. Exploitation requires user interaction but no privileges, and can be delivered over the network.

Critical Impact
A remote attacker can leak cross-origin data from the browser's Passwords implementation through a crafted HTML page, breaking the same-origin trust boundary.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers sharing the affected Passwords implementation
Desktop Stable channel builds referenced in the Chrome release notes

Discovery Timeline

2026-06-30 - CVE-2026-14019 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14019

Vulnerability Analysis

The vulnerability resides in the Passwords component of Google Chrome. An inappropriate implementation permits data associated with one origin to be observed by another origin. This violates the same-origin policy that browsers enforce to isolate web content. The attacker delivers the exploit through a crafted HTML page, meaning any drive-by visit to a malicious site can trigger the leak. Because the impact is confined to information disclosure, integrity and availability are not directly affected, but leaked credential-related data can enable follow-on attacks including account takeover and lateral movement.

Root Cause

The root cause is an implementation error in how the Passwords feature handles cross-origin boundaries. Under CWE-522, credentials or credential-adjacent data are not sufficiently isolated from untrusted origins. The Chromium issue tracker entry documents the specific code path patched in 150.0.7871.47. See the Chromium Issue Tracker Entry for the underlying report.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load an attacker-controlled HTML page in a vulnerable Chrome build. The malicious page uses standard web primitives to interact with the Passwords component and observe data belonging to a different origin. No authentication or elevated privileges are required. Because the delivery mechanism is a standard web page, exploitation scales through phishing, malvertising, and compromised sites.

No public exploit or proof-of-concept has been published, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog. Refer to the Google Chrome Update Blog for vendor context.

Detection Methods for CVE-2026-14019

Indicators of Compromise

Browser telemetry showing Chrome versions below 150.0.7871.47 connecting to previously unseen or low-reputation domains hosting HTML content
Repeated navigation events to attacker-controlled pages that immediately invoke DOM operations against form or credential-related elements
Anomalous outbound requests carrying credential-shaped payloads originating from Chrome renderer processes

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 150.0.7871.47
Correlate web proxy logs with endpoint browser version data to identify vulnerable clients visiting unclassified sites
Monitor for post-exploitation signals such as unexpected logins from new geolocations following credential leakage

Monitoring Recommendations

Ingest browser version and update-channel data into your SIEM to maintain continuous visibility of patch state
Alert on Chrome processes making cross-origin requests to domains not present in enterprise allow lists
Track authentication anomalies on SaaS applications heavily used by employees in the days following any suspected exposure

How to Mitigate CVE-2026-14019

Immediate Actions Required

Update all Google Chrome installations to version 150.0.7871.47 or later on Windows, macOS, and Linux
Force-restart Chrome after the update so the patched binaries load, since Chrome applies updates on relaunch
Verify update rollout through enterprise management tooling such as Chrome Browser Cloud Management or Group Policy
Educate users to avoid clicking untrusted links until patch coverage reaches 100%

Patch Information

Google addressed CVE-2026-14019 in Chrome Stable channel build 150.0.7871.47. Details are documented in the Google Chrome Update Blog. Chromium-based browsers that ingest upstream fixes should apply the corresponding merge as soon as their vendors publish updates.

Workarounds

Restrict browsing on unpatched endpoints to a curated allow list of trusted internal and business-critical domains
Enforce Chrome auto-update policies via ChromeAutoUpdateEnabled and UpdateDefault administrative templates
Disable or scope the built-in Password Manager for sensitive user populations until patching is confirmed

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version from the registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# macOS: read the CFBundleShortVersionString from the app bundle
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString