Google Chrome CVE-2026-14018

Exploitation requires the attacker to already have local access to a Windows host running a vulnerable Chrome build (prior to 150.0.7871.47) and to introduce a malicious file that the privileged Google Chrome Updater processes, which triggers the use-after-free (UI:R - some user or system interaction to act on the malicious file is required). Limiting factors: the attack vector is local, not network (AV:L), so it cannot be launched remotely; the target must be Windows specifically; and the target must be running an unpatched Chrome version - hosts with auto-update enabled are typically remediated automatically. No pre-existing elevated privileges are needed (PR:N), which is why the impact is privilege escalation to OS/SYSTEM level.

Signals are largely consistent and point to a real-but-not-urgent local privilege escalation. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High): local attack vector, low complexity, no privileges required, but user interaction required (a malicious file must be introduced/triggered). This is NOT remotely exploitable - an attacker must already have local footing on the host. EPSS is 0.11% (1st percentile) and the vulnerability is not on CISA KEV, so there is no evidence of active exploitation and no public exploit was identified. Google's own Chromium severity of 'Medium' is lower than the 7.8 CVSS, reflecting that the impact is local privilege escalation rather than remote compromise. No SSVC decision data was provided. Net: a legitimate patch-worthy issue for hardened/managed Windows fleets where local privilege boundaries matter, but low real-world priority relative to remotely exploitable Chrome renderer bugs; it should be swept up by normal Chrome auto-update rather than treated as an emergency.

An attacker who already has an unprivileged foothold on a Windows machine (e.g., via a phished standard-user account) plants a specially crafted malicious file that the elevated Chrome Updater processes, triggering the use-after-free and executing attacker-controlled code at SYSTEM to escalate from standard user to full host control. The local attack vector and low complexity make this practical once local access exists, but user interaction is required and no public proof-of-concept exploit has been identified.