CVE-2026-14384 Overview
CVE-2026-14384 is an out-of-bounds read vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.46 and allows a remote attacker to leak cross-origin data through a crafted HTML page. Chromium classifies the security severity as Medium. The weakness is tracked under CWE-125 (Out-of-bounds Read). Successful exploitation breaks the same-origin boundary that browsers rely on to isolate untrusted web content, exposing memory contents that should remain inaccessible to attacker-controlled JavaScript or WebGL calls.
Critical Impact
Remote attackers can leak cross-origin data from a victim's browser by luring them to a malicious web page that triggers the ANGLE out-of-bounds read.
Affected Products
- Google Chrome on Windows prior to 150.0.7871.46
- Chromium-based browsers embedding vulnerable ANGLE builds on Windows
- Applications using the affected ANGLE component through Chromium
Discovery Timeline
- 2026-07-01 - CVE-2026-14384 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-14384
Vulnerability Analysis
ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls into the underlying graphics API used by the host operating system, such as Direct3D on Windows. It runs inside Chrome's GPU process and handles buffers supplied by untrusted web content through WebGL and related APIs. An out-of-bounds read in this component means ANGLE reads memory beyond the intended buffer boundary during graphics processing. That out-of-scope memory can contain data belonging to other origins loaded in the same renderer or GPU process context.
Because the read result can influence rendered output or values returned to JavaScript, an attacker can observe leaked bytes indirectly and reconstruct cross-origin data. The vulnerability requires the victim to load a crafted HTML page, so no authentication or local access is needed.
Root Cause
The root cause is missing or incorrect bounds validation within ANGLE when processing attacker-influenced graphics inputs. Reading past the allocated buffer produces the memory disclosure classified under [CWE-125]. Specific technical detail is restricted in the Chromium Issue Tracker Entry pending broader patch adoption.
Attack Vector
Exploitation is fully remote and network-based. An attacker hosts a crafted HTML page that issues WebGL calls designed to trigger the out-of-bounds read in ANGLE. When a targeted user visits the page, the renderer or GPU process reads adjacent memory, and the attacker's JavaScript reads back values that reflect that memory. This enables inference of cross-origin resources such as authenticated responses from other sites. Refer to the Google Chrome Stable Update for release-level context.
Detection Methods for CVE-2026-14384
Indicators of Compromise
- Chrome browser versions on Windows reporting a version string earlier than 150.0.7871.46
- Web page loads that trigger unusually high WebGL activity from newly registered or low-reputation domains
- GPU process crashes or renderer anomalies coincident with visits to untrusted sites
Detection Strategies
- Inventory browser versions across managed Windows endpoints and flag hosts running Chrome builds older than 150.0.7871.46.
- Correlate browsing telemetry with threat intelligence to identify visits to domains hosting suspicious WebGL payloads.
- Alert on repeated GPU process termination events in Windows Application logs that may indicate exploitation attempts.
Monitoring Recommendations
- Ingest browser version telemetry into a centralized logging platform and build dashboards tracking patch compliance.
- Monitor DNS and proxy logs for outbound connections to unknown domains delivering large WebGL or shader payloads.
- Track Chrome update deployment progress against the fixed version 150.0.7871.46 on all Windows fleets.
How to Mitigate CVE-2026-14384
Immediate Actions Required
- Update Google Chrome on Windows to version 150.0.7871.46 or later across all endpoints.
- Restart browsers after the update to ensure the ANGLE component is reloaded from the patched build.
- Enforce automatic Chrome updates through Group Policy or endpoint management tooling to prevent regression.
Patch Information
Google addressed CVE-2026-14384 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fixed version on Windows is 150.0.7871.46. Administrators should validate deployment using Chrome's chrome://version page or fleet inventory data.
Workarounds
- Disable hardware acceleration in Chrome to reduce ANGLE exposure until patching completes, understanding this degrades graphics performance.
- Restrict access to untrusted web content through enterprise browser policies and web filtering while updates roll out.
- Use site isolation and strict cross-origin policies to reduce the value of any leaked data.
# Configuration example: enforce Chrome auto-update minimum version on Windows via registry
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.46" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
