CVE-2026-14105: Google Chrome Auth Bypass Vulnerability

CVE-2026-14105 Overview

CVE-2026-14105 is an insufficient policy enforcement vulnerability in the Speech component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can bypass the same origin policy by tricking a user into visiting a crafted HTML page. The flaw is categorized under [CWE-346: Origin Validation Error] and requires user interaction to trigger. Chromium classifies the internal security severity as Low, while the National Vulnerability Database (NVD) assigns a medium rating. Exploitation enables cross-origin information access through the Speech API, which can expose data that should remain isolated between web origins.

Critical Impact
A remote attacker can bypass the same origin policy through the Speech component, enabling unauthorized cross-origin interactions when a user loads a malicious page.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers using the vulnerable Speech component
Desktop stable channel builds released before the June 2026 update

Discovery Timeline

2026-06-30 - CVE-2026-14105 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14105

Vulnerability Analysis

The vulnerability resides in the Speech subsystem of Google Chrome, which exposes Web Speech API functionality to web pages. The component fails to correctly enforce the same origin policy when handling speech-related requests. A crafted HTML page can invoke Speech APIs in a way that bypasses origin checks, allowing an attacker-controlled document to interact with resources tied to a different origin.

The attack requires the victim to open or interact with a malicious page. No authentication is required, and the attack originates over the network. Impact is limited to integrity of data returned through the Speech interface. Confidentiality and availability remain unaffected according to the published CVSS vector.

Root Cause

The root cause is an origin validation failure [CWE-346] in the Speech component. Policy checks that should isolate speech recognition and synthesis flows between origins are either missing or incorrectly applied. As a result, the browser accepts input or delivers output across origin boundaries that same origin policy is designed to prevent.

Attack Vector

An attacker hosts a crafted HTML page and lures a target user to load it. When the page invokes the Speech API, the missing enforcement allows cross-origin interaction. Because the attack vector is network-based and complexity is low, mass phishing or malvertising campaigns are viable delivery mechanisms. See the Chromium Issue Tracker Entry for additional technical context.

No public proof of concept, exploit code, or evidence of exploitation in the wild has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-14105

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 in enterprise inventories
Web traffic to unknown domains that invoke Web Speech API endpoints shortly after page load
Unexpected microphone permission prompts originating from third-party embedded frames

Detection Strategies

Inventory Chrome installations and flag any endpoint reporting a version below 150.0.7871.47
Monitor browser telemetry for cross-origin script activity that references SpeechRecognition or SpeechSynthesis interfaces
Correlate URL reputation data with pages that request Speech API access from unfamiliar origins

Monitoring Recommendations

Ingest Chrome update status from endpoint management tools into a centralized logging platform for continuous version tracking
Enable web proxy logging with URL, referrer, and content-type fields to reconstruct suspicious page loads
Alert on execution of Chrome binaries with outdated version strings after the patch release date

How to Mitigate CVE-2026-14105

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Force browser restarts through endpoint management to ensure the patched binary is loaded
Verify auto-update policies are enabled and reaching all Chrome installations

Patch Information

Google addressed the vulnerability in Chrome stable channel 150.0.7871.47. Details are published in the Google Chrome Release Update. Administrators should validate deployment through Chrome's chrome://settings/help page or via enterprise management consoles.

Workarounds

Restrict microphone and Speech API permissions through Chrome enterprise policy until patching completes
Deploy web filtering rules that block untrusted domains from accessing Web Speech interfaces
Educate users to avoid unsolicited links and to deny microphone prompts from unfamiliar sites

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy example to disable Speech API defaults
# File: /etc/opt/chrome/policies/managed/speech.json
{
  "AudioCaptureAllowed": false,
  "AudioCaptureAllowedUrls": []
}