CVE-2026-14147: Google Chrome UXSS Vulnerability in CSS

CVE-2026-14147 Overview

CVE-2026-14147 is a Universal Cross-Site Scripting (UXSS) vulnerability in the Cascading Style Sheets (CSS) implementation of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.47 and is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). A remote attacker can inject arbitrary scripts or HTML by luring a victim to a crafted HTML page. Chromium classifies the internal severity as Low, while the CVSS assessment rates it Medium due to the cross-origin impact of UXSS. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
Successful exploitation enables script or HTML injection across origins, bypassing the same-origin policy and exposing user session data on any site the victim visits.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.47
Chromium-based browsers that share the vulnerable CSS engine code
Downstream distributions of Chrome that have not integrated the stable channel update

Discovery Timeline

2026-06-30 - CVE-2026-14147 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14147

Vulnerability Analysis

The vulnerability resides in Chrome's CSS implementation, where improper handling of certain CSS constructs allows content from an attacker-controlled origin to influence the rendering or scripting context of another origin. The result is a Universal Cross-Site Scripting condition, a subclass of [CWE-79] that operates at the browser layer rather than the web application layer. Because the injection occurs inside the browser itself, the same-origin policy no longer constrains attacker payloads. User interaction is required, meaning the victim must visit or interact with a crafted HTML page. Successful exploitation may lead to session theft, credential harvesting, or arbitrary DOM manipulation across arbitrary origins.

Root Cause

The root cause is an inappropriate implementation within Chrome's CSS parsing or rendering pipeline. The specific defect allows attacker-controlled markup or style content to escape the intended rendering boundary and execute scripts or inject HTML in a foreign security context. The Chromium project has not published detailed technical internals for this issue at the time of disclosure. See the Chromium Issue Tracker Entry for restricted issue metadata.

Attack Vector

Exploitation is remote and requires no privileges but does require user interaction. An attacker hosts a crafted HTML page containing malicious CSS. When the victim opens the page in a vulnerable Chrome build, the browser processes the CSS in a way that causes cross-origin script or HTML injection. The scope is changed, indicating impact beyond the vulnerable component to other browser origins. Confidentiality and integrity are affected at Low, with no direct availability impact.

No verified proof-of-concept code is publicly available. Refer to the Google Chrome Desktop Update announcement for the vendor summary.

Detection Methods for CVE-2026-14147

Indicators of Compromise

Chrome browser processes rendering HTML pages that contain anomalous CSS constructs targeting known UXSS gadgets
Unexpected outbound requests from browser sessions to attacker-controlled domains following visits to untrusted sites
Browser-generated script executions that reference cross-origin DOM contexts without a legitimate application source

Detection Strategies

Inventory Chrome installations across managed endpoints and flag builds earlier than 150.0.7871.47
Correlate browser process telemetry with proxy or DNS logs to identify visits to untrusted domains preceding suspicious script activity
Deploy web content filtering to log and alert on delivery of pages containing atypical CSS payloads referenced in threat intelligence feeds

Monitoring Recommendations

Track Chrome version compliance through endpoint management platforms and enforce automatic updates
Monitor authentication anomalies such as session token reuse from unexpected IP addresses that may indicate stolen cookies
Collect browser extension and update telemetry to confirm the stable channel patch has been applied across the fleet

How to Mitigate CVE-2026-14147

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating to ensure the patched binaries are loaded into active browser sessions
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their vendor updates that incorporate the fixed Chromium codebase

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Desktop Update advisory. Administrators should confirm the deployed version is at least 150.0.7871.47. Enterprise environments using Chrome Browser Cloud Management or group policy should force update rollout and disable version pinning that keeps clients on vulnerable builds.

Workarounds

Restrict user browsing to trusted sites through DNS filtering or secure web gateway policies until patching completes
Enforce Chrome auto-update policies via group policy or MDM to prevent users from deferring updates
Advise users to avoid clicking untrusted links and to report suspicious HTML content encountered in email or messaging platforms

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: query version from the application bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString