CVE-2026-14097: Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150

Synopsis

A sandbox escape vulnerability exists in the WebAppInstalls component of Google Chrome on macOS in versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, though it does require user interaction with a crafted HTML page; an attacker who has already compromised the renderer process can exploit an inappropriate implementation to break out of Chrome's sandbox entirely. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact on the host system. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted host must be reachable and the user must browse to the attacker-controlled content.

• AuthenticationNot required

  No account or credential of any kind is required; the attack is reachable by any anonymous remote party who can serve a web page.

• Victim interactionRequired

  The user must open or navigate to a crafted HTML page, making this a social-engineering-dependent attack that requires the victim to take an action in the browser.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special environmental conditions or race-condition requirements beyond a compromised renderer process.

Blast Radius

• A successful sandbox escape grants the attacker code execution outside Chrome's sandboxed renderer, at the privilege level of the macOS user running Chrome.
• The attacker reads arbitrary files and secrets accessible to that user account, including stored credentials, session tokens, and application data.
• The attacker modifies or deletes files on the host filesystem, including application binaries and user data stores.
• The attacker can crash or otherwise disrupt the host system or any process running under the same user context.