CVE-2026-14101: Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150

Synopsis

This is a sandbox escape vulnerability in Google Chrome on macOS affecting versions prior to 150.0.7871.47. A remote attacker who has already compromised the Chrome renderer process can exploit insufficient policy enforcement by serving a crafted HTML page, causing Chrome to break out of its sandbox containment. Successful exploitation grants the attacker capabilities beyond the sandboxed renderer, including full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected Chrome instance must be reachable or browsing attacker-controlled content via the internet.

• AuthenticationNot required

  No credentials or account are needed; the attacker only needs to serve a crafted page to a victim running an affected Chrome version.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker relies on social engineering or malicious ad delivery to get the user to load the page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions beyond the attacker having already compromised the renderer process.

Blast Radius

• The attacker escapes the Chrome sandbox and gains execution context outside the sandboxed renderer, with access to the broader macOS user session.
• Confidentiality impact is high: the attacker reads files, credentials, cookies, and other data accessible to the macOS user running Chrome.
• Integrity impact is high: the attacker writes or modifies files and system state on the host, including persistent artifacts like login items or application data.
• Availability impact is high: the attacker can crash, terminate, or otherwise disrupt processes and services on the host system.