CVE-2026-14050: Google Chrome Information Disclosure Flaw

CVE-2026-14050 Overview

CVE-2026-14050 is an insufficient policy enforcement vulnerability in the Passwords component of Google Chrome prior to version 150.0.7871.47. The flaw allows a remote attacker to leak cross-origin data by convincing a user to visit a crafted HTML page. Google Chromium classifies the security severity as Low, while the National Vulnerability Database (NVD) assigns a CVSS 3.1 base score of 6.5. The vulnerability maps to [CWE-693: Protection Mechanism Failure] and requires user interaction to succeed.

Critical Impact
Successful exploitation lets a remote attacker read cross-origin data handled by Chrome's Passwords component, bypassing same-origin protections through a malicious web page.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers sharing the same Passwords component code path
Desktop Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-06-30 - CVE-2026-14050 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14050

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords feature, which manages credential storage, autofill, and password disclosure workflows. The component fails to enforce policy checks that isolate data across web origins. As a result, a malicious page can reach data that the browser should scope strictly to another origin.

The issue is categorized under [CWE-693] because a protection mechanism intended to enforce origin boundaries does not run correctly for every code path. Exploitation targets confidentiality rather than integrity or availability, consistent with the NVD vector C:H/I:N/A:N. The attack requires the victim to load attacker-controlled HTML but no authentication.

The Exploit Prediction Scoring System (EPSS) probability is 0.247% as of 2026-07-02, indicating low near-term exploitation likelihood. No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists at publication time. See the Chromium Issue Tracker Entry for upstream tracking metadata.

Root Cause

The Passwords component performs an operation that touches cross-origin state without applying the same-origin policy enforcement expected for that path. This gap in policy checks lets a page in origin A observe data associated with origin B.

Attack Vector

An attacker hosts a crafted HTML page and lures a Chrome user to visit it. The page triggers the vulnerable code path in the Passwords component, causing the browser to disclose cross-origin data back to the attacker's page. No privileges are required, but user interaction is mandatory.

No verified proof-of-concept code is available for CVE-2026-14050.
Refer to the Chromium Issue Tracker for restricted technical details once opened.

Detection Methods for CVE-2026-14050

Indicators of Compromise

Chrome desktop clients reporting a version string earlier than 150.0.7871.47 in telemetry or chrome://version
Outbound requests from browser processes to newly registered or low-reputation domains immediately after user navigation to unfamiliar sites
Unexpected reads from the Chrome Login Data SQLite file or password-related IPC channels during a browsing session

Detection Strategies

Inventory installed Chrome versions across the fleet using endpoint management or software inventory queries and flag builds below 150.0.7871.47
Correlate web proxy logs with endpoint browser telemetry to identify users visiting untrusted HTML content while running vulnerable Chrome builds
Alert on browser child processes making anomalous network callbacks shortly after navigation events involving unclassified domains

Monitoring Recommendations

Track Chrome update compliance through group policy or MDM reporting and escalate hosts that fail to update within the patch SLA
Monitor DNS and HTTP telemetry for domains delivering obfuscated JavaScript that references password autofill APIs
Ingest browser event logs into a SIEM to build baselines for password-manager interactions and identify deviations

How to Mitigate CVE-2026-14050

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after deployment so the updated binaries load into memory
Verify enterprise-managed Chromium forks have pulled the corresponding upstream fix

Patch Information

Google released the fix in the Chrome Stable channel at version 150.0.7871.47. Administrators should deploy the update through the standard Chrome auto-update channel, Chrome Browser Cloud Management, or their software distribution tooling. Details are documented in the Google Chrome Stable Update release notes.

Workarounds

Disable Chrome's built-in password manager via enterprise policy (PasswordManagerEnabled=false) until patching completes
Restrict browsing to trusted sites through URL allow-lists enforced by a secure web gateway
Instruct users to avoid clicking links from untrusted email or messaging sources while a vulnerable Chrome build is present

bash

# Windows Group Policy registry example to disable Chrome password manager
reg add "HKLM\Software\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

# Verify installed Chrome version on Linux endpoints
google-chrome --version