CVE-2026-14047: Google Chrome Auth Bypass Vulnerability

CVE-2026-14047 Overview

CVE-2026-14047 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome prior to version 150.0.7871.47. The flaw allows an attacker who convinces a user to install a malicious extension to bypass Content Security Policy (CSP) via a crafted Chrome Extension. Chromium classifies the internal security severity as Low, and the National Vulnerability Database rates it Medium. The weakness is tracked under CWE-602: Client-Side Enforcement of Server-Side Security.

Critical Impact
A malicious Chrome extension can bypass Content Security Policy restrictions, undermining a core browser defense against script injection and unauthorized content loading.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers that ship the same Extensions policy enforcement code
Desktop Chrome Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-06-30 - CVE-2026-14047 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14047

Vulnerability Analysis

The vulnerability resides in how Google Chrome enforces policy within its Extensions subsystem. Content Security Policy is a browser mechanism that restricts which scripts, styles, and resources a page can execute or load. When policy enforcement is applied inconsistently between the extension runtime and the page context, an extension can perform actions that CSP is intended to block.

Exploitation requires user interaction: the victim must install a malicious extension from an untrusted source. Once installed, the extension leverages the weakness to bypass CSP on pages it can access, enabling script execution or resource loading that a properly enforced policy would prevent. The impact is limited to integrity, and confidentiality and availability are not directly affected according to the published vector.

Root Cause

The root cause maps to [CWE-602], client-side enforcement of a security decision that should be validated server-side or at a higher trust boundary. Chrome's Extensions layer trusts policy checks that a malicious extension can influence, allowing a crafted extension to sidestep CSP directives on target pages. The flaw is a logic and policy enforcement issue rather than a memory corruption bug.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker must publish or distribute a malicious Chrome Extension and social-engineer the target into installing it, typically through sideloading, a compromised extension store listing, or a fraudulent developer identity. After installation, the extension issues crafted API calls or injects content in a way that avoids CSP enforcement. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor context.

No public proof-of-concept exploit code has been released for CVE-2026-14047, and no verified code examples are available. The vulnerability mechanism is described in prose per available vendor references.

Detection Methods for CVE-2026-14047

Indicators of Compromise

Chrome browser instances running versions earlier than 150.0.7871.47 on managed endpoints.
Recently installed extensions from outside the Chrome Web Store or from unverified publishers.
Extensions requesting broad host permissions such as <all_urls> combined with scripting or declarativeNetRequest APIs.
Unexpected script execution or resource loads on pages that publish a restrictive CSP header.

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare against an approved allowlist.
Monitor Chrome version telemetry to identify endpoints below the patched build 150.0.7871.47.
Review browser and endpoint logs for extension installation events originating from non-Web Store sources.
Correlate CSP violation reports collected by web applications with the endpoints and users generating them.

Monitoring Recommendations

Enable enterprise Chrome reporting to centralize extension install, update, and permission events.
Ingest CSP report-to and report-uri endpoints into a SIEM for aggregation and alerting on anomalous violations.
Track extension IDs seen in the environment against threat intelligence feeds covering malicious Chrome extensions.

How to Mitigate CVE-2026-14047

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all endpoints and verify the installed build.
Audit currently installed extensions and remove any that are unapproved, unsigned, or sideloaded.
Restrict extension installation to the Chrome Web Store and to an explicit allowlist using enterprise policy.
Communicate to users that installing extensions from untrusted sources is required to trigger this vulnerability.

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. The corresponding Chromium fix is tracked in the Chromium Issue Tracker Entry. Administrators should confirm the deployed Chrome build is 150.0.7871.47 or newer across Windows, macOS, and Linux.

Workarounds

Configure the ExtensionInstallBlocklist policy with * and use ExtensionInstallAllowlist to permit only vetted extensions.
Set ExtensionInstallSources to prevent installation from arbitrary URLs and disable developer mode with DeveloperToolsAvailability.
For high-risk users, deploy managed Chrome profiles that block all third-party extensions until patching is verified.

bash

# Configuration example
# Chrome enterprise policy (Windows registry) to restrict extensions until patched
# HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f

# Allow only explicitly approved extension IDs
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Disable developer tools to prevent sideloading unpacked extensions
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f