CVE-2026-14405: Uninitialized Use in V8 in Google Chrome prior to 150

Synopsis

An uninitialized memory use vulnerability in the V8 JavaScript engine affects Google Chrome versions prior to 150.0.7871.46. The flaw is reachable over the network and requires no authentication, though the attacker must convince a user to visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution inside the Chrome sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a remote crafted HTML page, so the Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account, credential, or prior access to the target system is needed; any user who browses to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The attacker must socially engineer the victim into visiting a crafted HTML page, making user interaction a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Attacker executes arbitrary code within the Chrome renderer sandbox, gaining control over the sandboxed process.
• Sandboxed code execution with high confidentiality impact allows the attacker to read data accessible to the renderer, including in-page session tokens, form values, and cookies surfaced to the script context.
• High integrity impact means the attacker can modify page content, intercept or tamper with network requests made from the renderer, and inject malicious script into the browsing session.
• High availability impact means the attacker can crash or hang the renderer process, disrupting the user's browsing session and any web application running in the affected tab.