CVE-2026-14092: Google Chrome Information Disclosure Bug

CVE-2026-14092 Overview

CVE-2026-14092 is an insufficient policy enforcement vulnerability in the Privacy component of Google Chrome prior to version 150.0.7871.47. An attacker in a privileged network position can leak cross-origin data by sending crafted network traffic to a victim browser. Exploitation requires user interaction, such as visiting a page controlled or intercepted by the attacker. The issue affects Chrome on Windows, macOS, and Linux desktop platforms. Google classifies the Chromium security severity as Low, and the CWE mapping is [CWE-693] Protection Mechanism Failure.

Critical Impact
A network-adjacent attacker can bypass Chrome privacy policy enforcement to exfiltrate cross-origin data belonging to sites the victim visits.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome installations on Microsoft Windows, Apple macOS, and Linux
Downstream Chromium-based browsers that have not merged the upstream fix

Discovery Timeline

2026-06-30 - CVE-2026-14092 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14092

Vulnerability Analysis

The vulnerability resides in Chrome's Privacy subsystem, where policy enforcement fails to adequately isolate cross-origin data during specific network exchanges. An attacker positioned between the client and legitimate servers, such as on a shared Wi-Fi segment or compromised upstream router, can manipulate traffic to induce the browser to disclose data governed by same-origin policy. The result is a confidentiality-only impact; integrity and availability are not directly affected. Exploitation requires the victim to interact with attacker-influenced content, typically by navigating to a page or resource the attacker can observe or modify.

Root Cause

The root cause is a Protection Mechanism Failure [CWE-693] in how Chrome's Privacy component enforces cross-origin data boundaries when processing certain network responses. The policy layer does not consistently validate the origin context before returning data, allowing an on-path adversary to correlate or extract information across origins.

Attack Vector

Exploitation is network-based and requires an attacker in a privileged network position, such as a man-in-the-middle on an insecure link or a compromised network device. The attacker injects or modifies network traffic to trigger the flawed policy check in the target Chrome instance. User interaction is required, meaning the victim must load attacker-influenced content in a vulnerable Chrome build. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14092

Indicators of Compromise

Chrome desktop clients reporting a version string earlier than 150.0.7871.47 in enterprise inventory data.
Unexpected TLS interception, certificate mismatches, or downgraded HTTPS sessions observed against user browsing traffic.
Anomalous cross-origin request patterns in browser telemetry that correlate with a specific network egress path.

Detection Strategies

Query endpoint inventory data for installed Chrome build numbers and flag hosts running versions below 150.0.7871.47.
Correlate proxy and DNS logs to identify users traversing networks where MITM conditions are plausible, such as guest Wi-Fi or untrusted VPN egress points.
Alert on TLS validation errors and HTTP Strict Transport Security (HSTS) violations that indicate active on-path interference.

Monitoring Recommendations

Ingest browser version telemetry into a centralized data lake and build a recurring report on outdated Chrome installs.
Monitor network sensors for ARP spoofing, rogue DHCP, and unexpected route changes on user segments.
Track certificate transparency and pinning failures generated by managed Chrome fleets.

How to Mitigate CVE-2026-14092

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Enforce automatic update policies through enterprise management tooling to prevent version drift.
Restrict use of untrusted networks for sensitive browsing, or require a trusted VPN tunnel for remote users.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fix is included in Chrome 150.0.7871.47 and later builds for desktop platforms. Chromium-based browsers should pick up the upstream patch in their next release cycle.

Workarounds

Require HTTPS everywhere and enable HSTS preloading for internal domains to reduce MITM opportunities.
Deploy DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to limit passive interception of name resolution.
Advise users to avoid sensitive activity on public Wi-Fi until patched Chrome builds are deployed.

bash

# Verify installed Chrome version on Linux and macOS
google-chrome --version
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv