CVE-2026-14095: Insufficient policy enforcement in Browser in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in Google Chrome versions prior to 150.0.7871.47, caused by insufficient policy enforcement in the browser process. An attacker who has already compromised the Chrome renderer process can trigger the flaw remotely by serving a crafted HTML page, requiring only that a victim visit the page in their browser. Successful exploitation gives the attacker full read, write, and denial-of-service capability on the affected system, breaking out of Chrome's security sandbox entirely. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable to or able to connect to an attacker-controlled web origin.

• AuthenticationNot required

  No authentication is required; any user who visits the crafted page can be targeted without logging in to any service.

• Victim interactionRequired

  The victim must visit the attacker-crafted HTML page in their browser, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the renderer compromise precondition.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the host operating system.
• The attacker reads files and data accessible to the user running Chrome, including stored credentials, cookies, and session tokens.
• The attacker can write or modify files on the host, including planting malicious binaries or altering user data.
• The attacker can crash or disrupt the host-level browser process, causing a denial of service for the affected user.