CVE-2026-14090: Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150

Synopsis

An out-of-bounds memory read vulnerability exists in the CameraCapture component of Google Chrome on ChromeOS, affecting versions prior to 150.0.7871.47. The flaw is reachable over the network with no authentication or user interaction required: a remote attacker can trigger it by delivering a crafted HTML page. Successful exploitation gives the attacker read access to memory contents, the ability to tamper with data, and the ability to crash the affected process. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network; the vulnerable component is exposed to remote connections and can be triggered by serving a crafted HTML page.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to deliver the exploit.

• Victim interactionNot required

  No action is required from the victim; the attacker can trigger the vulnerability without any user participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads out-of-bounds memory contents, which may include session tokens, credentials, or other sensitive data held in the Chrome process.
• The attacker can tamper with in-memory data structures, potentially altering application state or injecting malicious content.
• The attacker can crash the affected Chrome process, denying camera capture functionality to the user.
• All three impacts (read, write, crash) are rated High in the CVSS record, meaning each represents full loss of confidentiality, integrity, or availability within the affected scope.