CVE-2026-14406 - Vulnerability Details

Description

Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

Published: 2026-07-01

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Out-of-bounds read in the V8 JavaScript engine of Google Chrome permits an attacker who delivers a malicious extension to read data residing in the browser process memory, potentially exposing sensitive information. The flaw is a bounds‑check failure (CWE‑125) that allows unintended disclosure through the extension context.

Affected Systems

Google Chrome versions before 150.0.7871.46 on all platforms are affected. The vulnerability resides in the V8 engine component included in the browser.

Risk and Exploitability

The CVSS score of 5.9 labels the issue as medium severity. The EPSS score of <1% and the absence from the CISA KEV catalog suggest a low current probability of exploitation. The attack vector requires the attacker to convince a user to install a malicious extension, which then can read portions of the browser’s memory. No remote code execution or full system compromise is implied by the description.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.46`	affected	< 150.0.7871.46

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.46,150.0.7871.46)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Google Chrome to version 150.0.7871.46 or later
Remove or uninstall extensions that come from untrusted or unknown sources
Audit extension permissions and avoid granting excessive privileges

Generated by OpenCVE AI on August 1, 2026 at 22:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0019.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513435594

History

Sat, 01 Aug 2026 22:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in V8 Allows Browser Memory Disclosure via Malicious Extension

Wed, 29 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
Title	Out-of-bounds Read in Chrome's V8 Engine via Malicious Extension

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-bounds Read in Chrome's V8 Engine via Malicious Extension

Tue, 21 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in V8 Engine via Malicious Chrome Extension

Fri, 17 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in V8 Engine via Malicious Chrome Extension

Wed, 15 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in Chrome V8 Engine via Malicious Extension

Mon, 13 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in Chrome V8 Engine via Malicious Extension

Sat, 11 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in Google Chrome V8 via Malicious Extension

Fri, 10 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in Google Chrome V8 via Malicious Extension

Thu, 09 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in V8 Enables Malicious Chrome Extension to Leak Process Memory

Wed, 08 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in V8 Enables Malicious Chrome Extension to Leak Process Memory

Tue, 07 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title	Out of Bounds Read in V8 Engine Leading to Sensitive Data Exposure via Malicious Extensions

Tue, 07 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Title		Out of Bounds Read in V8 Engine Leading to Sensitive Data Exposure via Malicious Extensions

Mon, 06 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in V8 via Malicious Chrome Extension

Sun, 05 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in V8 via Malicious Chrome Extension

Sun, 05 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
Title	V8 Out‑of‑Bounds Read Enables Sensitive Data Exposure via Malicious Chrome Extension

Sat, 04 Jul 2026 21:30:00 +0000

Type	Values Removed	Values Added
Title		V8 Out‑of‑Bounds Read Enables Sensitive Data Exposure via Malicious Chrome Extension

Sat, 04 Jul 2026 13:45:00 +0000

Type	Values Removed	Values Added
Title	V8 Out-of-Bounds Read in Chrome Allows Sensitive Data Leak via Malicious Extension

Sat, 04 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Title		V8 Out-of-Bounds Read in Chrome Allows Sensitive Data Leak via Malicious Extension

Fri, 03 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title	V8 Out‑of‑Bounds Read Enables Sensitive Data Exposure via Malicious Extension

Fri, 03 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title		V8 Out‑of‑Bounds Read Enables Sensitive Data Exposure via Malicious Extension

Thu, 02 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in Chrome V8 Allows Malicious Extension to Read Process Memory

Thu, 02 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in Chrome V8 Allows Malicious Extension to Read Process Memory

Thu, 02 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Thu, 02 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
Weaknesses		CWE-125
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513435594

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-07-01T22:21:53.998Z

Updated: 2026-07-02T00:33:00.247Z

Reserved: 2026-07-01T21:37:29.917Z

Link: CVE-2026-14406

Vulnrichment

Updated: 2026-07-02T00:32:47.938Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-01T22:30:06Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object