CVE-2026-14100: Google Chrome Information Disclosure Flaw

CVE-2026-14100 Overview

CVE-2026-14100 is a data validation flaw in the NetworkCache component of Google Chrome prior to version 150.0.7871.47. The vulnerability allows a remote attacker to leak cross-origin data by convincing a user to visit a crafted HTML page. The flaw stems from improper input validation [CWE-20] within the browser's network caching layer, which fails to enforce origin boundaries on cached responses. Google classified the Chromium security severity as Low, while the assigned CVSS 3.1 score is 6.5. The vulnerability affects Chrome installations on Windows, macOS, and Linux.

Critical Impact
A remote attacker can leak cross-origin data from other web origins by luring a victim to a crafted HTML page, breaking the browser's same-origin policy for cached content.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers sharing the affected NetworkCache code path

Discovery Timeline

2026-06-30 - CVE-2026-14100 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14100

Vulnerability Analysis

The vulnerability resides in Chrome's NetworkCache, the subsystem responsible for storing HTTP responses to accelerate subsequent requests. Insufficient validation of cached data allows an attacker-controlled page to influence how cross-origin responses are interpreted or served from cache. The result is a cross-origin information disclosure where sensitive response data from another origin becomes observable to attacker-controlled JavaScript.

Exploitation requires user interaction, specifically visiting or being redirected to a malicious HTML page. No authentication is required, and the attack is deliverable entirely over the network. Confidentiality is impacted, while integrity and availability of the browser remain intact.

Root Cause

The root cause is an input validation failure [CWE-20] in NetworkCache. The cache subsystem does not sufficiently validate attributes tied to cached entries, allowing an attacker's page to trigger conditions that expose data belonging to a different origin. This weakens the same-origin policy enforcement that browsers rely on to isolate web content.

Attack Vector

An attacker hosts a crafted HTML page containing JavaScript and resource requests engineered to interact with the flawed cache logic. When a victim visits the page, the browser processes the malicious content and, due to the validation gap, returns or exposes response data associated with a different origin. The attacker's script then reads the leaked data and exfiltrates it. See the Chromium Issue Report for technical details.

Detection Methods for CVE-2026-14100

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 on managed endpoints
Outbound connections from browser processes to newly registered or low-reputation domains hosting crafted HTML content
Unusual cross-origin fetch patterns preceded by user navigation to untrusted sites

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.47
Correlate browser telemetry with proxy and DNS logs to identify user visits to suspicious pages followed by anomalous cross-origin resource loads
Review web filtering logs for hits against threat intelligence feeds tracking Chrome exploit landing pages

Monitoring Recommendations

Enable enterprise Chrome reporting to centrally capture version and extension state
Monitor endpoint EDR telemetry for unexpected data flows originating from chrome.exe or the Chrome renderer processes
Alert on browsers that fail to update within the enterprise patch window defined by your policy

How to Mitigate CVE-2026-14100

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Force browser restart after update deployment to ensure the patched binary is loaded
Verify Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. Administrators should ensure automatic updates are enabled or push the update via enterprise management tooling. The EPSS score for this CVE is approximately 0.229% at the 13.6 percentile, indicating low near-term exploitation likelihood, but patching remains the definitive remediation.

Workarounds

Restrict browsing to trusted sites through web filtering until the update is deployed
Advise users to avoid clicking links from untrusted sources given the user-interaction requirement
Consider temporarily deploying Chromium-based alternatives already on a patched build for high-risk users

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read the version from the app bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString