CVE-2026-14065: Google Chrome Auth Bypass Vulnerability

CVE-2026-14065 Overview

CVE-2026-14065 affects Google Chrome versions prior to 150.0.7871.47. The flaw resides in the PageInfo component, which performs insufficient validation of untrusted input. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to bypass navigation restrictions. The Chromium project rated the underlying security severity as Low, while the National Vulnerability Database assigns a CVSS 3.1 base score of 6.5. The weakness maps to [CWE-20] Improper Input Validation. Exploitation requires prior renderer compromise and user interaction, limiting standalone impact but enabling chained attacks against browser sandbox and navigation policies.

Critical Impact
An attacker who controls a compromised renderer process can bypass Chrome navigation restrictions through a crafted HTML page, undermining integrity boundaries enforced by the browser.

Affected Products

Google Chrome prior to 150.0.7871.47 on Microsoft Windows
Google Chrome prior to 150.0.7871.47 on Apple macOS
Google Chrome prior to 150.0.7871.47 on Linux

Discovery Timeline

2026-06-30 - CVE-2026-14065 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14065

Vulnerability Analysis

The vulnerability exists within Chrome's PageInfo subsystem, which surfaces security and permission state to the browser UI and enforces navigation-related decisions. The component processes input originating from renderer processes without adequate validation. When an adversary already controls a renderer, that trust boundary becomes exploitable. The attacker supplies malformed or unexpected values that PageInfo accepts and acts upon, causing the browser process to permit navigations that policy would otherwise reject. Because the browser process operates outside the renderer sandbox, navigation restrictions enforced there constitute a security boundary. Bypassing them enables the attacker to redirect users, initiate cross-origin navigations, or reach URLs that renderer-imposed restrictions should block.

Root Cause

The root cause is improper input validation ([CWE-20]) in the PageInfo component. The code path assumes structural or semantic constraints on renderer-supplied data that are not enforced through explicit checks. A compromised renderer can violate those assumptions, causing downstream navigation logic to make decisions on attacker-controlled values.

Attack Vector

Exploitation is network-based but requires two conditions. First, the attacker must already have compromised a renderer process, typically by chaining a separate renderer-side vulnerability. Second, the victim must interact with a crafted HTML page. Once these preconditions are met, the attacker sends malformed data through the PageInfo interface to the browser process and triggers a navigation that violates Chrome's navigation restrictions. Details of the specific input format and code path are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14065

Indicators of Compromise

Chrome installations reporting versions earlier than 150.0.7871.47 in endpoint inventory data
Unexpected navigations to URLs that violate configured URLBlocklist or enterprise navigation policies
Renderer process crashes or anomalous IPC traffic to the browser process preceding suspicious navigations

Detection Strategies

Query endpoint inventory for Chrome executables with version strings below 150.0.7871.47 across Windows, macOS, and Linux hosts
Correlate browser telemetry with proxy and DNS logs to flag navigations that bypass expected allow/block lists
Alert on renderer sandbox escape indicators such as unusual child process creation from chrome.exe following visits to untrusted pages

Monitoring Recommendations

Ingest Chrome enterprise reporting events into a centralized SIEM for continuous version and policy compliance visibility
Monitor web proxy logs for navigation patterns inconsistent with configured Chrome enterprise policies
Track outbound traffic from endpoints to newly registered or low-reputation domains delivering crafted HTML content

How to Mitigate CVE-2026-14065

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome browsers to ensure the patched binary is loaded, as pending updates do not apply until relaunch
Verify enterprise-managed fleets through Chrome Browser Cloud Management or equivalent MDM reporting

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update. Administrators should confirm deployment of Chrome 150.0.7871.47 or later. No exploit is publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but patching remains the definitive remediation.

Workarounds

Restrict browsing to trusted sites using Chrome enterprise policies such as URLBlocklist and URLAllowlist until patching completes
Enable Enhanced Safe Browsing to increase the likelihood of blocking crafted pages hosting renderer exploits
Reduce attack surface by disabling unnecessary Chrome extensions that expand the renderer attack surface

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion