CVE-2026-14038: Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150

Synopsis

This is an insufficient input validation vulnerability in the New Tab Page component of Google Chrome versions prior to 150.0.7871.47. It is reachable over the network and requires no authentication, but does require the victim to interact with a crafted HTML page; additionally, the attacker must have already compromised the renderer process before exploiting this flaw. Successful exploitation enables a sandbox escape, granting the attacker elevated access beyond the browser sandbox and allowing them to read sensitive data and tamper with files or system state on the host. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable from or directed to an attacker-controlled remote origin.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attack is initiated by getting the victim to visit a crafted page.

• Victim interactionRequired

  The victim must open a crafted HTML page, making social engineering or malicious ad/link delivery a necessary part of the attack chain.

• Attack complexityDetail

  The base exploit is considered low complexity once conditions are met, though a prerequisite renderer-process compromise must already be in place before this vulnerability can be leveraged for sandbox escape.

Blast Radius

• Reads sensitive data accessible to the browser process outside the sandbox, including stored credentials, cookies, and local files the browser user can access.
• Modifies files or system state on the host by breaking out of the Chrome sandbox and operating with the privileges of the browser's OS-level user account.
• The availability impact is rated None in the CVSS vector, so crash or denial-of-service of the host system is not a direct consequence of this specific vulnerability.