CVE-2026-14037: Insufficient policy enforcement in GPU in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in Google Chrome's GPU process, affecting all versions prior to 150.0.7871.47. An attacker who has already compromised the Chrome renderer process can trigger this flaw by serving a crafted HTML page over the network, requiring no authentication but needing the victim to visit the page. Successful exploitation breaks out of Chrome's sandbox, giving the attacker code execution outside the browser's isolation boundary, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must navigate to or be directed to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout; however, a prior renderer compromise is a prerequisite.

Blast Radius

• Attacker breaks out of the Chrome sandbox and gains code execution in the context of the host process, outside the browser's isolation boundary.
• With high confidentiality impact, the attacker reads files, stored credentials, session tokens, and other user data accessible to the browser process on the host.
• With high integrity impact, the attacker writes or modifies files and data on the host system beyond what the sandboxed renderer could reach.
• With high availability impact, the attacker crashes or disrupts the host-level process, potentially destabilizing other running applications on the same system.