CVE-2026-14109: Insufficient policy enforcement in Mojo in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in the Mojo IPC framework used by Google Chrome versions prior to 150.0.7871.47. It is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page and the attacker must have already compromised the Chrome renderer process. Successful exploitation lets the attacker break out of Chrome's sandbox, gaining full access to the underlying host system including reads, writes, and arbitrary code execution. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted HTML page over the network, so the affected Chrome instance must be reachable or browsing to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; any user who visits the crafted page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page in Chrome, making this a browser-based social-engineering vector.

• Attack complexityDetail

  Exploit conditions are described as low-complexity and condition-free once the renderer is compromised, though a renderer compromise is itself a prerequisite chained step.

Blast Radius

• A successful attacker escapes Chrome's renderer sandbox and gains code execution on the host operating system.
• Confidential data accessible to the host process, including stored credentials, session tokens, and local files, becomes readable.
• The attacker can write or modify files on the host, including binaries and configuration, enabling persistence.
• The host process can be crashed or its resources exhausted, disrupting service for the affected system.