CVE-2026-14105: Insufficient policy enforcement in Speech in Google Chrome prior to 150

Synopsis

This is a same-origin policy bypass in the Speech component of Google Chrome prior to version 150.0.7871.47, caused by insufficient policy enforcement. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives a remote attacker full read, write, and denial-of-service capability across cross-origin content, including data from other browser tabs or frames. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach a remotely hosted crafted HTML page.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated user visiting the crafted page is a valid target.

• Victim interactionRequired

  The victim must be socially engineered into visiting or loading a crafted HTML page, making user interaction a required step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout assumptions, or other environmental factors to succeed.

Blast Radius

• A successful attacker reads content from cross-origin pages, including session tokens, form data, and authenticated responses belonging to other sites open in the browser.
• The attacker writes to or modifies cross-origin content, allowing manipulation of data or actions performed in the context of other origins.
• The attacker can crash or disrupt the affected browser context, causing denial of service for the victim's active session.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the originating page to other browser origins and frames the victim has open.