CVE-2026-14097: Google Chrome RCE Vulnerability on Mac

CVE-2026-14097 Overview

CVE-2026-14097 is an inappropriate implementation flaw in the WebAppInstalls component of Google Chrome on macOS versions prior to 150.0.7871.47. The weakness allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox using a crafted HTML page. Sandbox escape vulnerabilities break a core security boundary that isolates untrusted web content from the host operating system. Chromium rates the underlying issue at Low severity, while the NVD assessment scores it as Critical due to the impact of a successful sandbox escape. The flaw is tracked under CWE-693: Protection Mechanism Failure.

Critical Impact
A successful exploit chains renderer compromise with a sandbox escape, giving an attacker code execution outside Chrome's isolation boundary on macOS.

Affected Products

Google Chrome on macOS prior to 150.0.7871.47
Apple macOS (host operating system for the affected Chrome build)
Chromium-based deployments that share the vulnerable WebAppInstalls implementation on macOS

Discovery Timeline

2026-06-30 - CVE-2026-14097 published to NVD
2026-07-01 - Last updated in NVD database
2026-06 - Google releases fixed build 150.0.7871.47 via the Stable Channel Update for Desktop

Technical Details for CVE-2026-14097

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls feature on macOS, which handles installation flows for Progressive Web Apps (PWAs) and web-based application shortcuts. An inappropriate implementation in this component fails to enforce the process boundary that separates the renderer sandbox from higher-privileged browser processes. Attackers require an existing renderer compromise as a prerequisite, meaning this bug is typically chained with a separate memory corruption or logic bug in the renderer. Once chained, a crafted HTML page can drive the flawed install flow to execute actions outside the sandbox. The attack requires user interaction, and successful exploitation changes the scope of the initial compromise. Additional technical context is tracked in the Chromium Issue Tracker entry 513333529.

Root Cause

The root cause is a protection mechanism failure [CWE-693] in the macOS-specific implementation of WebAppInstalls. The component does not sufficiently validate or constrain requests arriving from a renderer that an attacker controls. Because the install workflow interacts with browser-privileged APIs, insufficient enforcement of the renderer-to-browser trust boundary lets an attacker leverage the compromised renderer to reach functionality that should be gated.

Attack Vector

Exploitation proceeds in two stages. First, the attacker compromises the renderer process, typically through a separate Chrome vulnerability triggered by malicious web content. Second, the attacker delivers a crafted HTML page that abuses the WebAppInstalls flow to cross the sandbox boundary on macOS. The attack is network-reachable, requires low complexity, and needs user interaction such as visiting the attacker-controlled page. No verified public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS estimate places the near-term exploitation probability at 0.234%.

No verified public exploit code is available. Refer to the Chromium Issue Tracker for technical details as Google releases them.

Detection Methods for CVE-2026-14097

Indicators of Compromise

macOS endpoints running Google Chrome versions below 150.0.7871.47, identifiable via the Google Chrome.app/Contents/Info.plistCFBundleShortVersionString value
Unexpected creation of PWA shortcut bundles under ~/Applications/Chrome Apps.localized/ or ~/Library/Application Support/Google/Chrome/Web Applications/ outside normal user activity
Chrome child processes spawning non-standard child binaries or writing to paths inconsistent with sandboxed renderer behavior
Outbound connections from Chrome renderer processes to newly registered or low-reputation domains prior to install-flow activity

Detection Strategies

Inventory Chrome versions across macOS fleets and alert on any host still running a build below 150.0.7871.47
Monitor process lineage for Chrome helper processes (Google Chrome Helper (Renderer)) initiating unexpected privileged operations or filesystem writes outside the sandbox profile
Correlate browser navigation telemetry with subsequent PWA install events to identify install flows triggered by pages the user did not intentionally interact with
Baseline normal WebAppInstalls activity per user and flag deviations such as installs from ephemeral or first-seen domains

Monitoring Recommendations

Ingest macOS Endpoint Security Framework (ESF) events covering process execution and file creation into your detection pipeline for continuous Chrome behavior analysis
Track Chrome update compliance through MDM reporting (Jamf, Kandji, Intune) and generate alerts when versions drift below the fixed release
Enable and centralize Chrome Enterprise reporting to capture extension, navigation, and install events for retrospective hunting

How to Mitigate CVE-2026-14097

Immediate Actions Required

Update Google Chrome on all macOS endpoints to 150.0.7871.47 or later without delay
Force a browser restart after deployment so the patched binary is loaded across all Chrome processes
Validate patch coverage using MDM inventory queries and remediate any hosts still running vulnerable builds
Restrict installation of PWAs via enterprise policy where the feature is not required by the business

Patch Information

Google addressed CVE-2026-14097 in the macOS Stable channel release 150.0.7871.47. Deployment details are documented in the Google Chrome Stable Channel Update for Desktop. Enterprises using Chrome Enterprise should push the update through their management channel and verify rollout with the chrome://version page or MDM version telemetry.

Workarounds

Disable web app installs using the WebAppInstallForceList and DefaultWebAppInstallForceAllowed policies, or block installs entirely via WebAppSettings until patching is complete
Reduce renderer exposure by enforcing Safe Browsing Enhanced Protection and blocking navigation to untrusted sites through URL filtering
Apply macOS application allow-listing to restrict execution of unexpected binaries spawned from browser processes

bash

# Enforce minimum Chrome version and disable web app installs on managed macOS endpoints
# /Library/Managed Preferences/com.google.Chrome.plist (deployed via MDM)

defaults write com.google.Chrome WebAppInstallForceList -array
defaults write com.google.Chrome DefaultWebAppInstallForceAllowed -bool false

# Verify installed Chrome version meets the patched build
/usr/bin/defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString
# Expected output: 150.0.7871.47 or higher