CVE-2026-14064: Google Chrome Use-After-Free Vulnerability

CVE-2026-14064 Overview

CVE-2026-14064 is a use-after-free vulnerability in the PageInfo component of Google Chrome on Android. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker who convinces a user to perform specific user interface gestures can execute arbitrary code through a crafted HTML page. The vulnerability is tracked under CWE-416: Use After Free and Chromium classifies the internal severity as Low, though NVD scores it HIGH due to the code execution impact.

Critical Impact
Successful exploitation enables arbitrary code execution in the Chrome renderer context on Android devices, subject to user interaction with attacker-crafted content.

Affected Products

Google Chrome for Android versions prior to 150.0.7871.47
Chromium-based mobile browsers sharing the affected PageInfo code path
Android WebView deployments incorporating vulnerable Chromium builds

Discovery Timeline

2026-06-30 - CVE-2026-14064 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14064

Vulnerability Analysis

The vulnerability resides in Chrome's PageInfo subsystem on Android. PageInfo handles the security and site information surface presented when a user interacts with the address bar padlock or site controls. A use-after-free condition occurs when an object referenced by PageInfo is freed while a pointer to it remains reachable. Subsequent access to that dangling pointer allows an attacker to influence memory contents at the freed location.

Exploitation requires user interaction. The attacker must convince the target to visit a crafted HTML page and perform specific UI gestures that trigger the vulnerable code path. Once triggered, the freed memory can be reclaimed with attacker-controlled data, enabling control flow hijack and arbitrary code execution within the browser process.

The attack complexity is elevated because reliable exploitation depends on precise timing, heap grooming, and user-driven gesture sequencing. Details are tracked in the Chromium Issue Tracker Entry.

Root Cause

The root cause is improper object lifetime management in PageInfo. An object is released while another code path retains a reference, producing a dangling pointer. Dereferencing that pointer after reallocation enables attacker-influenced memory reuse, the classic pattern described by CWE-416.

Attack Vector

The attack vector is network-based. The attacker hosts a crafted HTML page and lures the victim into loading it in Chrome on Android. The victim must then perform targeted UI gestures that invoke the PageInfo flow. See the Google Chrome Stable Update for the release notes covering the fix.

Detection Methods for CVE-2026-14064

Indicators of Compromise

Unexpected Chrome renderer or browser process crashes on Android referencing PageInfo in tombstone logs
Outbound connections from Chrome to unfamiliar hosts immediately following user gestures on a suspicious page
Android application crash dumps showing signal SIGSEGV within Chromium browser components

Detection Strategies

Inventory Chrome for Android installations across managed devices and flag versions below 150.0.7871.47
Correlate mobile device management (MDM) telemetry with browser crash reports to surface anomalous PageInfo faults
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains hosting HTML content targeting mobile browsers

Monitoring Recommendations

Enforce automatic Chrome updates via Google Play managed configurations and alert on devices lagging behind the current stable channel
Ingest Android logcat and crash telemetry into a central data lake to detect repeated renderer faults tied to browsing sessions
Track threat intelligence feeds referencing Chromium issue 502714977 for public exploit development

How to Mitigate CVE-2026-14064

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Push forced browser updates to managed Android fleets using MDM policies
Advise users to avoid interacting with the address bar or site info controls on untrusted pages until patched

Patch Information

Google addressed the vulnerability in Chrome 150.0.7871.47 on the stable channel. The fix is documented in the Google Chrome Stable Update release notes and the corresponding Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted domains via mobile web filtering until updates are deployed
Disable or block installation of Chrome versions below 150.0.7871.47 through enterprise mobility policies
Educate users to avoid unfamiliar UI gesture prompts on untrusted web pages

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 150.0.7871.47 or later