CVE-2026-14063: Google Chrome Information Disclosure Flaw

CVE-2026-14063 Overview

CVE-2026-14063 is an out-of-bounds read vulnerability [CWE-125] in the Chromecast component of Google Chrome versions prior to 150.0.7871.47. An attacker on the adjacent network can send crafted network traffic to trigger the read, exposing bytes from Chrome's process memory. Google classifies the Chromium security severity as Low, while the NVD assigns a CVSS 3.1 base score of 5.7.

The flaw affects Chrome on Windows, macOS, and Linux desktops. Exploitation requires user interaction and network adjacency, which limits opportunistic abuse but remains relevant on shared or untrusted wireless networks.

Critical Impact
A local attacker on the same network segment can leak potentially sensitive information from Chrome process memory through malicious Chromecast traffic.

Affected Products

Google Chrome prior to 150.0.7871.47
Microsoft Windows desktop installations of Chrome
Apple macOS and Linux desktop installations of Chrome

Discovery Timeline

2026-06-30 - CVE-2026-14063 published to the National Vulnerability Database
2026-07-01 - Last updated in the NVD database
2026-07-02 - EPSS score recorded at 0.141% (percentile 3.789)

Technical Details for CVE-2026-14063

Vulnerability Analysis

The vulnerability resides in Chrome's Chromecast integration, which handles device discovery and media streaming over the local network. When Chrome parses inbound Chromecast protocol messages, a boundary check on a buffer read is insufficient. The affected code path reads beyond the intended buffer length and returns adjacent process memory to the caller path.

Because the read occurs during network message handling, an attacker positioned on the same Wi-Fi or LAN segment can trigger it by sending crafted packets to a Chrome instance. Leaked memory may contain URLs, tokens, session identifiers, or heap pointers useful for bypassing address space layout randomization (ASLR). The issue does not corrupt memory, so it cannot directly execute code.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in Chromecast message handling. The parser trusts a length or index derived from attacker-controlled input without validating it against the actual buffer bounds. Chrome release 150.0.7871.47 corrects the bounds check.

Attack Vector

Exploitation requires adjacent network access and user interaction, such as an active browsing session with Chromecast discovery enabled. The attacker crafts Chromecast protocol traffic and delivers it to the victim host over the local network. No authentication is required against the target. See the Chromium Issue Tracker Entry for the upstream report.

No public proof-of-concept, exploit module, or in-the-wild exploitation has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-14063

Indicators of Compromise

Unexpected Chromecast discovery or mDNS traffic originating from unmanaged hosts on the local subnet.
Chrome renderer or utility processes generating unusual outbound traffic shortly after receiving Chromecast messages.
Endpoints running Chrome versions earlier than 150.0.7871.47 that are exposed to guest or shared wireless networks.

Detection Strategies

Inventory installed Chrome versions across Windows, macOS, and Linux endpoints and flag builds below 150.0.7871.47.
Monitor local network segments for anomalous Chromecast (_googlecast._tcp) traffic patterns and malformed protocol messages.
Correlate browser crash telemetry with concurrent inbound multicast or unicast traffic on Chromecast ports.

Monitoring Recommendations

Enable browser telemetry and crash reporting to surface repeated faults in the Chromecast component.
Alert on new devices advertising Chromecast services on corporate or high-value network segments.
Track Chrome update compliance through endpoint management tooling and escalate stalled updates.

How to Mitigate CVE-2026-14063

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after applying the update to ensure the patched binary is loaded into all processes.
Verify version rollout through fleet management and prioritize systems used on shared or public networks.

Patch Information

Google addressed the issue in the Chrome stable channel update announced in the Google Blog Chrome Update. The fix corrects the bounds check in the Chromecast component. Upstream tracking is available in the Chromium Issue Tracker Entry.

Workarounds

Disable Chromecast media routing via the MediaRouterCastAllowAllIPs and related enterprise policies until patching completes.
Restrict Chrome hosts from untrusted wireless networks and isolate guest Wi-Fi from corporate segments.
Block inbound Chromecast discovery traffic at the network layer where casting is not required.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output: Google Chrome 150.0.7871.47 or later

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion