CVE-2026-14102: Google Chrome Use After Free Vulnerability

CVE-2026-14102 Overview

CVE-2026-14102 is a use-after-free vulnerability [CWE-416] in the Passwords component of Google Chrome prior to version 150.0.7871.47. A remote attacker can exploit heap corruption by convincing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the browser renderer or associated process context.

The issue affects Chrome desktop builds across Windows, macOS, and Linux. Google addressed the flaw in the June 2026 Stable Channel update. Chromium classifies the internal security severity as Low, but NVD scoring places network-based impact with user interaction at CVSS 8.8.

Critical Impact
Remote attackers can trigger heap corruption via a malicious webpage, enabling potential code execution in Chrome's Passwords subsystem.

Affected Products

Google Chrome Desktop for Windows prior to 150.0.7871.47
Google Chrome Desktop for macOS prior to 150.0.7871.47
Google Chrome Desktop for Linux prior to 150.0.7871.47

Discovery Timeline

2026-06-30 - CVE-2026-14102 published to NVD
2026-07-02 - Last updated in NVD database
June 2026 - Google releases fixed Chrome Stable build 150.0.7871.47 via the Google Chrome Desktop Update

Technical Details for CVE-2026-14102

Vulnerability Analysis

The flaw resides in Chrome's Passwords component, which manages saved credentials, autofill flows, and password import/export operations. A use-after-free condition occurs when the component references heap-allocated memory after it has already been released. An attacker who controls the timing of allocation and deallocation can reclaim the freed slot with attacker-controlled data.

Once the dangling pointer is dereferenced, the browser operates on attacker-shaped memory. This gives an adversary primitives for heap corruption that can be chained into arbitrary read, write, or control-flow hijack scenarios. The Passwords surface is reachable through routine web interactions such as login prompts and form autofill triggers.

Root Cause

The root cause is improper object lifetime management in the Passwords subsystem. Code paths retain a raw pointer or reference to an object after another execution path frees it, violating ownership invariants tracked by Chromium's memory model. See the Chromium Issue Tracker #513455047 for internal tracking details.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers the page through a malicious site, a compromised legitimate site, malvertising, or a phishing link. User interaction is limited to visiting the page, which then triggers the vulnerable code path in the Passwords component through scripted DOM operations and credential-related APIs.

No verified public proof-of-concept exists at the time of publication. Refer to the Chromium Issue Tracker #513455047 once access restrictions are lifted for exploitation specifics.

Detection Methods for CVE-2026-14102

Indicators of Compromise

Chrome renderer or utility process crashes with heap corruption signatures such as USE_AFTER_FREE reports in crashpad telemetry.
Unexpected child processes spawned by chrome.exe following navigation to untrusted domains.
Outbound connections from Chrome to newly registered or low-reputation domains hosting credential-themed pages.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build below 150.0.7871.47.
Correlate browser crash telemetry with subsequent process creation or network anomalies to surface exploitation attempts.
Deploy behavioral endpoint identification that inspects post-exploitation activity such as shellcode execution, LOLBin invocation, or credential access originating from browser processes.

Monitoring Recommendations

Forward Chrome enterprise reporting and endpoint telemetry into a centralized data lake — for example, Singularity Data Lake — for cross-source correlation.
Monitor for anomalous child processes of chrome.exe, chrome, or Google Chrome Helper using Singularity Endpoint behavioral AI to identify browser-based exploitation.
Alert on browser-initiated writes to autorun locations, scheduled tasks, or credential stores immediately after navigation events.

How to Mitigate CVE-2026-14102

Immediate Actions Required

Update Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binary is loaded across all processes.
Enforce automatic browser updates through enterprise policy to close the exposure window on future Chromium disclosures.

Patch Information

Google released the fix in the Chrome Stable Channel build 150.0.7871.47. Deployment details and full changelog are available in the Google Chrome Desktop Update advisory. Managed environments should push the update through Chrome Browser Cloud Management, Group Policy, Jamf, Intune, or the platform package manager.

Workarounds

Restrict browsing to trusted sites through enterprise URL allowlists until patching completes.
Disable Chrome password autofill and import features via policy where credential workflows are not required.
Isolate high-risk browsing in a hardened profile or remote browser isolation service to contain renderer compromise.

bash

# Configuration example: enforce Chrome auto-update and minimum version via policy

# Windows Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.47" /f

# macOS managed preferences
defaults write com.google.Chrome UpdateDefault -int 1
defaults write com.google.Chrome TargetVersionPrefix -string "150.0.7871.47"

# Linux (Debian/Ubuntu) package upgrade
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable
google-chrome --version