CVE-2026-14120: Inappropriate implementation in DevTools in Google Chrome prior to 150

Synopsis

A sandbox escape vulnerability exists in the DevTools component of Google Chrome prior to version 150.0.7871.47. An attacker who has already compromised the Chrome renderer process can exploit this flaw by delivering a crafted HTML page to a victim, bypassing the browser sandbox and gaining capabilities outside the renderer's normally restricted environment. Successful exploitation gives the attacker full read, write, and availability impact on the host, including data disclosure, content tampering, and service disruption. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No credentials or account are needed; the attacker only requires the victim to load a page.

• Victim interactionRequired

  The victim must navigate to or load the attacker-controlled HTML page, making this a social-engineering vector requiring user action.

• Attack complexityDetail

  The exploit is reliable and does not depend on race conditions or specific environmental conditions, though it does require a prior renderer compromise as a stepping stone.

Blast Radius

• A successful attacker escapes the Chrome sandbox, gaining execution capabilities outside the renderer's restricted process.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files, becomes readable by the attacker.
• The attacker can write or modify data on the host, including files and persistent browser state.
• The host process or dependent services can be crashed or disrupted, causing loss of availability.