CVE-2026-14113: Use after free in Updater in Google Chrome on Windows prior to 150

Synopsis

A use-after-free vulnerability exists in the Updater component of Google Chrome on Windows in versions prior to 150.0.7871.47. The flaw is reachable over the network without authentication, but requires the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside Chrome's sandboxed renderer with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected host must be reachable or the user must browse to an attacker-controlled resource over the internet.

• AuthenticationNot required

  No credentials are needed; the attack is initiated by a remote unauthenticated party serving a malicious page.

• Victim interactionRequired

  The targeted user must visit and render the crafted HTML page, making social engineering or a malicious ad/link a necessary part of the attack chain.

• Attack complexityDetail

  Exploit conditions are low-complexity and largely free of environmental dependencies, though the attacker must already have compromised the renderer process as a prerequisite before triggering the Updater use-after-free.

Blast Radius

• Escapes Chrome's renderer sandbox, gaining code execution in a higher-privilege process context on the Windows host.
• Reads arbitrary files and stored secrets accessible to the Chrome process, including saved passwords, cookies, and session tokens.
• Writes or modifies files and registry entries on the host, enabling persistence or tampering with locally stored data.
• Crashes or destabilizes the browser process and, depending on post-exploitation behavior, can disrupt availability of the affected Windows system.