CVE-2026-14104: Google Chrome RCE Vulnerability

CVE-2026-14104 Overview

CVE-2026-14104 is an input validation flaw in the WebAppInstalls component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim browser. The issue is tracked under [CWE-20: Improper Input Validation] and stems from the browser accepting untrusted input without sufficient sanitization during web application install flows. Google addressed the flaw in a stable channel release for the desktop browser. While Google classified the Chromium severity as Low, the NVD assigned a CVSS 3.1 base score of 9.8 due to network reachability and lack of required privileges or user interaction.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox by luring users to a crafted HTML page.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based builds that share the vulnerable WebAppInstalls code path
Any downstream browser distribution built on an unpatched Chromium branch

Discovery Timeline

2026-06-30 - CVE-2026-14104 published to the National Vulnerability Database
2026-07-02 - Last updated in the NVD database

Technical Details for CVE-2026-14104

Vulnerability Analysis

The defect resides in the WebAppInstalls subsystem, which handles the installation of Progressive Web Applications and related web app manifests. The component fails to properly validate untrusted input drawn from remote HTML content during the install workflow. An attacker who controls a web page can craft manifest data or install parameters that cause Chrome to mishandle the input and execute attacker-controlled logic inside the renderer sandbox.

Execution occurs within the sandbox boundary rather than at full user privilege. Attackers still gain code execution primitives that can be chained with a sandbox escape to achieve full compromise. The vulnerability is classified as Improper Input Validation under [CWE-20].

Root Cause

The root cause is insufficient validation of attacker-controlled data flowing into the WebAppInstalls path. The component trusts fields supplied by the loaded HTML page and its associated web app manifest without enforcing strict type, length, or structural checks. When malformed input reaches downstream handlers, the browser reaches an unsafe state that allows code execution primitives within the renderer process.

Attack Vector

Exploitation requires only that a user visit a crafted HTML page hosted by the attacker or delivered through a compromised third-party site. No authentication or user interaction beyond page navigation is required. The vulnerability is remotely reachable across the network, making drive-by download campaigns, malvertising, and phishing links viable delivery mechanisms.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker #513484193 and the Google Chrome Stable Update for vendor technical detail.

Detection Methods for CVE-2026-14104

Indicators of Compromise

Unexpected chrome.exe or renderer processes spawning child processes after visiting an unfamiliar site
Unusual web app manifest fetches or manifest.json requests to attacker-controlled domains in browser telemetry
Chrome instances running below version 150.0.7871.47 after the patch release window

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 150.0.7871.47
Inspect proxy and DNS logs for traffic to newly registered or low-reputation domains serving crafted HTML content
Monitor endpoint telemetry for anomalous behavior originating from Chrome renderer processes, including unexpected file writes or IPC activity

Monitoring Recommendations

Alert on Chrome child process creation chains that deviate from baseline browser behavior
Track browser version drift through configuration management or EDR software inventory
Correlate web filtering logs with EDR process telemetry to identify visits to sites immediately preceding suspicious renderer activity

How to Mitigate CVE-2026-14104

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force-restart Chrome processes after the update to ensure the vulnerable binary is unloaded from memory
Validate patch deployment via software inventory reporting rather than user self-attestation

Patch Information

Google fixed CVE-2026-14104 in the stable channel release documented in the Google Chrome Stable Update. Upgrade to Chrome 150.0.7871.47 or later. Downstream Chromium-based browsers should apply the corresponding upstream fix once integrated into their build.

Workarounds

Restrict web app installation via enterprise policy using WebAppInstallForceList and DefaultWebAppInstallation controls where feasible
Deploy web filtering to block access to untrusted or newly observed domains until patching completes
Advise users to avoid clicking install prompts on unfamiliar sites until Chrome is updated

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Enterprise policy example: block arbitrary web app installs (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v WebAppInstallForceList /t REG_SZ /d "[]" /f