CVE-2026-14111: Google Chrome Use After Free Vulnerability

CVE-2026-14111 Overview

CVE-2026-14111 is a use-after-free vulnerability in the WebProtect component of Google Chrome versions prior to 150.0.7871.47. An attacker who convinces a user to install a malicious Chrome extension can trigger the flaw and execute arbitrary code on the host system. The issue is categorized under CWE-416 and affects Chrome across Windows, macOS, and Linux desktop platforms. Google addressed the flaw in the Stable channel update released through the Chrome Releases blog. Although Chromium rates the underlying bug as Low severity, the NVD assigns it a High rating due to arbitrary code execution potential.

Critical Impact
A crafted Chrome extension can trigger memory corruption in WebProtect and lead to arbitrary code execution in the browser process context.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux desktop platforms
Chromium-based deployments incorporating vulnerable WebProtect code paths

Discovery Timeline

2026-06-30 - CVE-2026-14111 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14111

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition inside Chrome's WebProtect component. A use-after-free occurs when a program continues to reference a memory region after that memory has been released. Attackers who control the layout and timing of allocations can reclaim the freed region with attacker-controlled data. Subsequent dereferences then operate on that controlled data, leading to arbitrary code execution within the browser process. The Chromium project tracks the underlying defect in issue 513710926.

Root Cause

The root cause is improper object lifetime management in WebProtect. Code paths reachable from an installed extension retain a pointer to an object after its backing memory has been deallocated. When the dangling pointer is later dereferenced, execution flow can be redirected. This class of defect is common in complex C++ codebases where object ownership crosses component boundaries such as extension APIs, renderer processes, and browser services.

Attack Vector

Exploitation requires social engineering. The attacker must convince a target to install a malicious Chrome Extension crafted to trigger the specific WebProtect code path. Once installed, the extension performs a sequence of API calls that force the allocation, free, and reuse conditions needed to control the freed object. Successful exploitation yields arbitrary code execution with the privileges of the browser process. The attack complexity is High because timing and memory layout must be controlled, but no additional authentication or user interaction is required beyond extension installation.

No public proof-of-concept or exploit code has been released for this issue. Refer to the Chromium Issue Tracker Entry for technical details once the bug becomes public.

Detection Methods for CVE-2026-14111

Indicators of Compromise

Installation of unreviewed Chrome extensions from outside the Chrome Web Store or from newly created publisher accounts.
Chrome renderer or browser process crashes with heap corruption signatures on systems running versions before 150.0.7871.47.
Unexpected child processes spawned by chrome.exe following extension installation events.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allowlist of approved IDs.
Alert on Chrome binaries whose reported version is below 150.0.7871.47 using endpoint software inventory data.
Monitor for anomalous outbound network connections initiated by the Chrome browser process shortly after extension install events.

Monitoring Recommendations

Enable Chrome enterprise reporting to forward extension install, update, and permission-change events to a central log store.
Correlate extension telemetry with process creation and file modification events on the endpoint.
Track Chrome crash telemetry through Windows Error Reporting or equivalent macOS and Linux crash pipelines for signs of memory corruption.

How to Mitigate CVE-2026-14111

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Audit installed extensions and remove any that are unknown, unused, or sourced from untrusted publishers.
Enforce an extension allowlist through Chrome enterprise policy to block installation of arbitrary extensions.

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. Managed environments should push the updated build through their existing software distribution tooling and validate the version string post-deployment. Chromium-derived browsers should incorporate the upstream patch referenced in the Chromium Issue Tracker Entry.

Workarounds

Configure the ExtensionInstallBlocklist policy set to * and use ExtensionInstallAllowlist to permit only vetted extension IDs.
Restrict extension installation to the Chrome Web Store and disable developer mode on managed devices via DeveloperToolsAvailability.
Educate users to reject prompts requesting installation of extensions from unofficial sources or unsolicited links.

bash

# Chrome enterprise policy example (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f