CVE-2026-14056: Insufficient validation of untrusted input in Media in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in the Media component of Google Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but does require the attacker to first compromise the renderer process and then trick a user into opening a crafted video file. Successful exploitation allows a remote attacker to break out of Chrome's sandbox, gaining full access to the host system with the ability to read, modify, or destroy data and disrupt services. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network, as the attack vector is network-exposed (AV:N), meaning any internet-facing or network-accessible Chrome instance is in scope.

• AuthenticationNot required

  No account or credential is needed to initiate the attack; the crafted video file can be delivered to an unauthenticated user (PR:N).

• Victim interactionRequired

  The victim must open or interact with a crafted video file, making this exploit dependent on a social-engineering step that delivers the malicious media to the target user (UI:R).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors, though it does require a prior renderer process compromise as a prerequisite.

Blast Radius

• The attacker escapes Chrome's sandbox and gains code execution in the context of the host OS process, bypassing the browser's primary isolation boundary.
• With sandbox escape achieved, the attacker reads files accessible to the Chrome process user, including stored credentials, session cookies, and local application data.
• The attacker modifies or deletes files on the host, including configuration files, application data, or other user-owned resources.
• Full confidentiality, integrity, and availability impact (C:H/I:H/A:H) means the attacker can crash, corrupt, or exfiltrate from the affected host without further privilege escalation.