CVE-2026-14107: Google Chrome Use-After-Free Vulnerability

CVE-2026-14107 Overview

CVE-2026-14107 is a use-after-free vulnerability [CWE-416] in the Scheduling component of Google Chrome versions prior to 150.0.7871.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by delivering a crafted HTML page to a target user. Successful exploitation requires user interaction, such as visiting an attacker-controlled website. While Chromium rates the internal security severity as Low, the National Vulnerability Database assigns a High severity due to the potential for arbitrary code execution with impact on confidentiality, integrity, and availability. The flaw affects Chrome deployments on Windows, macOS, and Linux.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox through a crafted HTML page, enabling browser compromise as an initial foothold for further attacks.

Affected Products

Google Chrome prior to 150.0.7871.47
Microsoft Windows (Chrome desktop builds)
Apple macOS and Linux (Chrome desktop builds)

Discovery Timeline

2026-06-30 - CVE-2026-14107 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14107

Vulnerability Analysis

The vulnerability resides in Chrome's Scheduling subsystem, which manages task ordering and execution across the renderer's threading model. A use-after-free condition occurs when the code accesses a memory region previously freed by the scheduler. An attacker can influence object lifetimes through carefully constructed JavaScript and Document Object Model (DOM) interactions delivered via a malicious HTML page.

Once the freed object is referenced, the attacker can substitute controlled data in the reclaimed heap slot. This primitive enables corruption of function pointers or virtual tables, leading to arbitrary code execution. Execution occurs inside the Chrome renderer sandbox, but sandboxed code often serves as the first stage in a chained exploit targeting further sandbox escape vulnerabilities.

Root Cause

The root cause is improper object lifetime management in the Scheduling code path. A pointer to a scheduler-owned object remains reachable after the underlying memory is deallocated. When the code later dereferences that stale pointer, it operates on memory that may be controlled by the attacker.

Attack Vector

Exploitation requires the victim to load an attacker-controlled HTML page in Chrome. The page contains JavaScript that triggers the specific sequence of scheduler operations required to free and then reuse the target object. No authentication is required and the attack is delivered over the network. Refer to Chromium Issue Report #513544566 for available technical details.

Detection Methods for CVE-2026-14107

Indicators of Compromise

Chrome renderer processes crashing with signals consistent with heap corruption or invalid memory access on hosts running versions prior to 150.0.7871.47.
Unexpected child process creation from chrome.exe, Google Chrome Helper, or Linux Chrome renderer processes following visits to untrusted web content.
Outbound network connections from Chrome renderer processes to previously unseen domains hosting complex or obfuscated JavaScript.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build earlier than 150.0.7871.47.
Correlate browser crash telemetry with recent URL history to identify potential exploitation attempts against unpatched clients.
Hunt for anomalous process lineage where Chrome renderer or helper processes spawn shells, scripting engines, or download utilities.

Monitoring Recommendations

Ingest browser process telemetry, crash dumps, and DNS query logs into a centralized analytics platform for retrospective hunting.
Monitor endpoint EDR alerts for memory integrity violations and exploit mitigation triggers originating from Chrome processes.
Track proxy and web gateway logs for known malicious domains delivering exploit HTML and associated JavaScript payloads.

How to Mitigate CVE-2026-14107

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after deploying the update to ensure the patched binary is active in memory.
Prioritize patching for high-risk users such as administrators, developers, and executives with elevated access.

Patch Information

Google addressed the vulnerability in Chrome Stable channel version 150.0.7871.47. See the Chrome Desktop Update Announcement for release notes and rollout details. Deploy the update through managed software distribution tools or Chrome's built-in automatic update mechanism.

Workarounds

Restrict browsing to trusted sites using web filtering or DNS-layer controls until patching is complete.
Enable Chrome's Site Isolation and Enhanced Safe Browsing to reduce the exposure surface for renderer-based exploits.
Consider temporary use of an alternative browser for high-risk workflows on hosts that cannot be updated immediately.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion