CVE-2026-14074 Overview
CVE-2026-14074 is a side-channel information leakage vulnerability in the WebAuthentication component of Google Chrome on iOS. Versions prior to 150.0.7871.47 allow a remote attacker to leak cross-origin data through a crafted HTML page. The flaw is tracked under [CWE-1300] (Improper Protection of Physical Side Channels) and [CWE-203] (Observable Discrepancy). Chromium rates the internal security severity as Low, while NVD assigns a medium CVSS 3.1 score. Exploitation requires user interaction, such as visiting an attacker-controlled webpage. No public proof-of-concept, exploit code, or in-the-wild abuse has been reported at the time of publication.
Critical Impact
A remote attacker can leak sensitive cross-origin data from the victim's browser session by luring them to a crafted HTML page, undermining the same-origin policy that isolates web content.
Affected Products
- Google Chrome on iOS versions prior to 150.0.7871.47
- WebAuthentication component within affected Chrome iOS builds
- Downstream applications embedding vulnerable Chrome iOS WebView behavior
Discovery Timeline
- 2026-06-30 - CVE-2026-14074 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-14074
Vulnerability Analysis
The vulnerability resides in the WebAuthentication (WebAuthn) implementation used by Google Chrome on iOS. WebAuthn is the W3C standard for public-key credential authentication in browsers. The affected code path exposes an observable discrepancy that a remote page can measure to infer information belonging to a different origin. This breaks the browser's cross-origin isolation guarantees.
The attack proceeds entirely over the network. A user only needs to visit a malicious HTML page for the leakage to occur, without additional privileges. The confidentiality impact is high, while integrity and availability remain unaffected. Successful exploitation exposes data that the victim has associated with unrelated origins, such as authentication state or credential presence indicators.
Root Cause
The root cause combines two weakness classes. [CWE-1300] indicates the WebAuthentication code fails to protect against physical or logical side-channel observation. [CWE-203] indicates the code produces observable differences, such as timing variations or response discrepancies, that reveal secret-dependent state. Together, these allow an attacker to distinguish states that should remain indistinguishable across origins.
Attack Vector
An attacker hosts a crafted HTML page that invokes WebAuthentication APIs and measures observable behavior. When the victim visits the page, the page issues probing operations and analyzes response characteristics. The measured signal correlates with cross-origin data the attacker cannot directly access. See the Chromium Issue Tracker Entry for component-level detail.
No verified proof-of-concept code is available. The vulnerability manifests through measurable discrepancies in WebAuthn API responses, not through classical memory corruption. Refer to the Google Chrome Stable Update for the vendor announcement.
Detection Methods for CVE-2026-14074
Indicators of Compromise
- Chrome on iOS build strings below 150.0.7871.47 reported by managed devices in inventory telemetry.
- Outbound connections from mobile devices to unknown domains that host pages invoking navigator.credentials.get() or navigator.credentials.create() in unusual patterns.
- Repeated, high-frequency WebAuthentication API calls from a single origin, indicative of timing measurement loops.
Detection Strategies
- Inventory iOS devices via MDM and flag Chrome installations below the patched version.
- Monitor web proxy and DNS logs for user visits to newly registered or low-reputation domains that serve WebAuthn-heavy JavaScript.
- Correlate browser telemetry with user reports of unexpected authentication prompts on mobile Chrome.
Monitoring Recommendations
- Enable browser version reporting through enterprise mobility management to surface out-of-date Chrome iOS instances.
- Alert on repeated cross-origin PublicKeyCredential invocations from a single tab within short time windows.
- Review authentication server logs for anomalous WebAuthn assertion attempts that may follow a successful cross-origin leak.
How to Mitigate CVE-2026-14074
Immediate Actions Required
- Update Google Chrome on iOS to version 150.0.7871.47 or later through the Apple App Store.
- Push forced-update policies via MDM to ensure all managed iOS devices receive the patched build.
- Advise users to avoid visiting untrusted links on mobile Chrome until the update is confirmed installed.
Patch Information
Google released the fix in Chrome for iOS 150.0.7871.47. Details are available in the Google Chrome Stable Update release notes. The corresponding tracking entry is the Chromium Issue Tracker Entry. Apply the update on every managed iOS endpoint.
Workarounds
- Restrict browsing on iOS to trusted domains through MDM web content filters until patching completes.
- Disable or restrict WebAuthentication-dependent workflows on mobile Chrome for high-risk users temporarily.
- Encourage users to switch to a patched browser or platform for authentication-sensitive tasks pending update rollout.
# Verify Chrome for iOS version through MDM query
# Compare reported CFBundleShortVersionString against the patched build
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString
# Expected patched value or higher: 150.0.7871.47
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
