CVE-2026-14145: Google Chrome UXSS Vulnerability in CSS

CVE-2026-14145 Overview

CVE-2026-14145 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome caused by an inappropriate implementation in the CSS component. Versions of Chrome prior to 150.0.7871.47 allow a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Chromium rates the security severity as Low, while the CVSS Base Score is 6.1. Exploitation requires user interaction, such as visiting an attacker-controlled page, and results in a scope change that impacts data confidentiality and integrity across origins.

Critical Impact
A successful UXSS attack lets a remote attacker execute scripts in the context of other web origins, bypassing the same-origin policy and exposing session data across sites the victim visits.

Affected Products

Google Chrome versions prior to 150.0.7871.47 on desktop platforms
Chromium-based browsers incorporating the affected CSS implementation
Any web application rendered inside a vulnerable Chrome instance

Discovery Timeline

2026-06-30 - CVE-2026-14145 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14145

Vulnerability Analysis

The vulnerability resides in Chrome's CSS implementation. Improper handling of certain CSS constructs allows attacker-controlled content to escape its intended parsing context. The result is a Universal Cross-Site Scripting condition, where injected scripts or HTML execute in the context of a different origin than the attacker's page. Because UXSS bypasses the browser's same-origin policy, an attacker can read authenticated content, exfiltrate cookies not marked HttpOnly, and perform actions on behalf of the victim on unrelated sites. The CVSS vector indicates a scope change and low-integrity, low-confidentiality impact, consistent with cross-origin script injection triggered through a crafted page. According to EPSS data from 2026-07-02, the probability of exploitation in the wild remains low, and no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is an inappropriate implementation within the CSS parsing or style-application logic in Blink. When the engine processes maliciously structured CSS in a crafted HTML page, it fails to enforce origin boundaries or output-encoding invariants. This gap enables markup or script content to be treated as executable in a foreign origin's context. Full technical detail is restricted in the Chromium Issue Tracker #514485825 pending broader user patching.

Attack Vector

An attacker hosts a crafted HTML page containing malicious CSS. When a victim using a vulnerable Chrome build visits the page, the CSS engine mishandles the input and injects arbitrary scripts or HTML into another origin's document tree. The attack requires user interaction (visiting the page) but no privileges or authentication. The vulnerability manifests through normal browsing over the network; see the Google Chrome Stable Update for release context.

Detection Methods for CVE-2026-14145

Indicators of Compromise

Browser telemetry showing Chrome versions below 150.0.7871.47 connecting to untrusted or newly registered domains
Unexpected outbound requests from browser processes to attacker-controlled hosts following visits to pages containing unusual CSS payloads
Anomalous cross-origin fetch or XMLHttpRequest activity from renderer processes

Detection Strategies

Inventory endpoints and flag Chrome installations reporting a version string lower than 150.0.7871.47
Inspect web proxy and DNS logs for user navigation to pages containing suspicious CSS or HTML payloads correlated with subsequent cross-origin requests
Deploy Content Security Policy (CSP) reporting endpoints on managed web properties to surface unexpected script injection attempts

Monitoring Recommendations

Continuously monitor Chrome browser version compliance against 150.0.7871.47 or later using endpoint management tooling
Alert on renderer processes spawning unusual child processes or performing atypical file system access after web navigation
Correlate browsing telemetry with authentication events to detect potential cross-origin session abuse

How to Mitigate CVE-2026-14145

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
Enforce automatic browser updates through group policy or mobile device management
Restart Chrome after the update completes to ensure the patched binary is loaded

Patch Information

Google addressed CVE-2026-14145 in the Chrome Stable channel release 150.0.7871.47. Administrators should validate deployment through the Google Chrome Stable Update announcement and confirm the version by navigating to chrome://settings/help on each host. Chromium-based browsers derived from the affected build should be updated to their vendor-supplied equivalent release.

Workarounds

Restrict user browsing to trusted sites through web filtering until patch rollout completes
Deploy strict Content Security Policy headers on sensitive applications to reduce the impact of injected scripts
Set SameSite=Strict and HttpOnly flags on session cookies to limit exposure from cross-origin script execution

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enforce minimum version via Chrome Enterprise policy (JSON)
# /etc/opt/chrome/policies/managed/version_policy.json
{
  "BrowserSignin": 2,
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}