CVE-2026-14058: Google Chrome Auth Bypass Vulnerability

CVE-2026-14058 Overview

CVE-2026-14058 is a Content Security Policy (CSP) bypass vulnerability in the parser component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can bypass CSP protections by serving a crafted HTML page to a victim who visits an attacker-controlled resource. The flaw is classified under CWE-693: Protection Mechanism Failure and is rated by Chromium as Low severity. Successful exploitation requires user interaction, such as loading a malicious page, and undermines a defensive control that web applications rely on to constrain script execution and resource loading.

Critical Impact
Remote attackers can bypass Content Security Policy through a crafted HTML page, weakening a defense-in-depth control against cross-site scripting and data exfiltration.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers inheriting the same parser code
Desktop Chrome Stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-14058 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14058

Vulnerability Analysis

The vulnerability resides in the Chrome parser, where policy enforcement fails to constrain content the way the browser's Content Security Policy directives specify. CSP is designed to restrict which scripts, styles, and resources a page may load. When the parser processes attacker-supplied HTML, it does not apply CSP directives consistently, allowing content to load or execute outside the declared policy boundaries. The attack vector is network based and requires user interaction. Confidentiality is not directly affected, but integrity is impacted at a limited level because policy assumptions made by the hosting site can be violated. This weakness is meaningful for sites that treat CSP as a primary XSS mitigation. Chromium categorized the issue as Low severity, and the EPSS probability remains low.

Root Cause

The root cause is insufficient policy enforcement in the HTML parser [CWE-693]. Specific parser paths process elements or attributes without checking the active CSP context, allowing the browser to instantiate resources that the policy should block.

Attack Vector

An attacker hosts a crafted HTML page and lures the user to visit it. When the browser parses the page, restricted content executes despite CSP directives. The technique is typically chained with a cross-site scripting or open-redirect primitive to defeat CSP on a target site.

No verified public proof-of-concept code is available. See the Chromium Issue Tracker Entry for developer-facing technical details as they become public.

Detection Methods for CVE-2026-14058

Indicators of Compromise

Browser telemetry showing execution of inline scripts or resource loads that violate a declared CSP without corresponding report-uri or report-to entries.
Outbound requests to unexpected domains from user agents identifying as Chrome versions below 150.0.7871.47.
HTML content served from untrusted origins that includes constructs targeting the affected parser paths referenced in the Chromium Issue Tracker Entry.

Detection Strategies

Enable and monitor CSP violation reporting on production web properties, and alert on anomalous violation patterns tied to Chrome user agents.
Inventory browser versions across managed endpoints and flag hosts still running Chrome below 150.0.7871.47.
Correlate web proxy logs with endpoint browser versions to identify users who visit high-risk domains from unpatched Chrome builds.

Monitoring Recommendations

Ingest browser version telemetry and CSP report endpoints into a centralized analytics pipeline for continuous tracking.
Track Google's stable channel release notes and match observed browser versions against the patched build 150.0.7871.47.
Review web application logs for spikes in CSP report-only violations, which may indicate active exploitation attempts.

How to Mitigate CVE-2026-14058

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints.
Force a browser restart after deployment to ensure the patched binary is loaded.
Audit enterprise Chrome update policies to confirm automatic updates are not disabled.

Patch Information

Google addressed CVE-2026-14058 in the Chrome Stable channel update to 150.0.7871.47. Deployment details are available in the Google Chrome Stable Update advisory. Chromium-based browsers should apply the equivalent upstream fix once vendors release updates.

Workarounds

Restrict browsing to trusted sites through enterprise URL filtering until patching completes.
Harden CSP directives on owned web properties by minimizing use of unsafe-inline and unsafe-eval, reducing the value of a bypass.
Deploy Chrome enterprise policies that enforce automatic update installation and block user deferral.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version