CVE-2026-14113: Google Chrome Use After Free Vulnerability

CVE-2026-14113 Overview

CVE-2026-14113 is a use-after-free vulnerability [CWE-416] in the Updater component of Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can leverage this bug to escape the Chrome sandbox using a crafted HTML page. Sandbox escape moves attacker code from the constrained renderer into a higher-privileged process running on the host. Google addressed the issue in the Stable channel update for desktop released in June 2026.

Critical Impact
Successful exploitation allows attackers to break out of the Chrome renderer sandbox on Windows, expanding a browser-based compromise into host-level code execution.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows systems running vulnerable Chrome builds
Chromium-based downstream browsers that share the affected Updater code path

Discovery Timeline

2026-06-30 - CVE-2026-14113 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14113

Vulnerability Analysis

The vulnerability resides in the Chrome Updater component on Windows. A use-after-free condition [CWE-416] occurs when the Updater references memory that has already been released. Attackers who have compromised the renderer process can trigger the condition through a crafted HTML page. The renderer sends messages that reach the Updater interface, and improper object lifetime handling allows the freed memory to be reused.

Exploitation chains this primitive with the renderer compromise to achieve a sandbox escape. Sandbox escape is the second stage of a typical browser exploit chain, following an initial renderer bug. Once outside the sandbox, attacker code runs with the privileges of the Chrome process rather than the restricted renderer token.

Google assigned a Chromium severity of Low, while the NVD CVSS score reflects the network-reachable, user-interaction-based nature of the browser attack surface.

Root Cause

The root cause is improper object lifetime management inside the Updater. Code paths reachable from the renderer retain or dereference a pointer after the underlying object has been freed. Reallocation of the freed slot with attacker-influenced data enables control of the reused memory contents.

Attack Vector

Attackers deliver a crafted HTML page to a victim who visits the site with a vulnerable Chrome build. The attack requires a prior renderer compromise, typically achieved through a chained memory corruption bug. User interaction is required to load the malicious page. See the Chromium Issue Tracker Entry for tracking details.

No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported. The EPSS estimate places the near-term exploitation probability at 0.244%.

Detection Methods for CVE-2026-14113

Indicators of Compromise

Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe from a browser context
Unusual writes by Chrome or its Updater to directories outside standard user profile paths
Crash dumps referencing the Updater component with heap corruption or access-violation signatures
Outbound network connections from Chrome-spawned processes to unfamiliar infrastructure following a page visit

Detection Strategies

Inventory Chrome versions across Windows endpoints and flag any build below 150.0.7871.47
Monitor process lineage where chrome.exe or the Chrome Updater is the parent of non-browser executables
Correlate browser crash telemetry with subsequent process creation or persistence events on the same host

Monitoring Recommendations

Ingest Windows process creation events (Event ID 4688 or Sysmon Event ID 1) and alert on Chrome process ancestry anomalies
Track Chrome auto-update telemetry to confirm all endpoints have moved to the patched build
Review endpoint logs for repeated Chrome Updater crashes preceding suspicious activity

How to Mitigate CVE-2026-14113

Immediate Actions Required

Update Google Chrome on all Windows endpoints to 150.0.7871.47 or later
Restart the browser after updating so the patched Updater binary is active in memory
Verify enterprise policy is not blocking Chrome auto-updates on managed fleets
Audit browser deployments to identify Chromium-based clients that share the affected code and apply vendor updates

Patch Information

Google released the fix in the Stable channel update for desktop, moving Chrome to version 150.0.7871.47 and later. Refer to the Google Chrome Update Announcement for release details.

Workarounds

No vendor workaround is published; apply the patch as the primary control
Restrict browsing to trusted sites and enforce web filtering to reduce exposure to crafted HTML delivery
Enable Windows attack surface reduction rules that limit child process creation from browsers

bash

# Confirm Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome update via administrative template on managed endpoints
gpupdate /force