CVE-2026-18004: Google Chrome Speech Information Disclosure

CVE-2026-18004 Overview

CVE-2026-18004 is an insufficient policy enforcement vulnerability in the Speech component of Google Chrome prior to version 151.0.7922.72. The flaw allows a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. Google classifies the Chromium security severity as Low. The issue affects Chrome desktop builds and was addressed in the stable channel update covering version 151.0.7922.72.

Critical Impact
An attacker with a compromised renderer can bypass same-origin restrictions in the Speech subsystem to exfiltrate data belonging to other web origins loaded in the browser.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected Speech component
Downstream distributions that had not yet integrated the stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-18004 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18004

Vulnerability Analysis

The vulnerability resides in the Speech subsystem of Chrome, which exposes APIs such as the Web Speech API for synthesis and recognition. Insufficient policy enforcement in this component means that origin boundaries are not correctly validated during certain Speech operations. When these checks fail, data associated with one origin can be observed or influenced by code executing in the context of another.

The issue is a same-origin policy bypass. It requires a prerequisite: the attacker must already control the renderer process. This typically means chaining CVE-2026-18004 with a separate renderer compromise, such as a V8 type confusion or use-after-free. On its own, the flaw does not grant code execution or sandbox escape.

Once chained, the attacker leverages the weak policy checks in Speech to read cross-origin resources that should remain isolated. This can expose authenticated content, tokens, or user data from unrelated sites loaded in the browser.

Root Cause

The root cause is inadequate enforcement of origin boundaries within the Speech component. Browser processes rely on strict validation to ensure that speech-related requests and responses honor the same-origin policy. Missing or incomplete checks allow cross-origin data to flow through the Speech interface when invoked from a compromised renderer.

Attack Vector

Exploitation requires a two-stage attack. First, the attacker delivers a crafted HTML page that compromises the renderer process, typically via a separate memory-corruption or logic bug. Second, the attacker uses the compromised renderer to invoke Speech APIs in a way that bypasses origin checks and reads data from other origins. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for additional context.

Detection Methods for CVE-2026-18004

Indicators of Compromise

Chrome desktop clients reporting a version older than 151.0.7922.72 in enterprise inventory data
Unexpected invocations of Web Speech API endpoints originating from pages that do not use speech features
Renderer process crashes or anomalies preceding cross-origin data access patterns

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome build below 151.0.7922.72
Correlate renderer-process instability events with subsequent outbound traffic to attacker-controlled domains
Review browser telemetry for anomalous Speech API usage tied to untrusted or newly registered domains

Monitoring Recommendations

Enable enterprise browser reporting to centralize Chrome version and extension telemetry
Monitor DNS and proxy logs for connections to domains hosting exploit chains that target Chromium renderers
Track patch compliance metrics for Chrome installations across Windows, macOS, and Linux fleets

How to Mitigate CVE-2026-18004

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome sessions to ensure the patched binary is loaded after update
Validate that Chromium-based browsers used in the environment have integrated the equivalent upstream fix

Patch Information

Google addressed CVE-2026-18004 in the Chrome stable channel release documented in the Google Chrome Desktop Update. Administrators should deploy 151.0.7922.72 or newer through managed update channels. Additional technical detail is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict access to untrusted web content using enterprise browser policies until patches are deployed
Use group policy to enforce automatic Chrome updates and disable version pinning on managed devices
Consider disabling the Web Speech API via enterprise policy where the feature is not required for business use

bash

# Configuration example
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry policy to enforce Chrome auto-update (example path)
# HKLM\SOFTWARE\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60