Google Chrome CVE-2026-14041

Exploitation requires the victim to open a crafted HTML page in a Chrome build prior to 150.0.7871.47 - user interaction is mandatory (CVSS UI:R), so this is not a drive-by against a fully passive user in the strictest sense but needs page navigation. The affected surface is specifically the Serial (Web Serial API) component and its policy enforcement, so exposure is limited to environments where that browser feature/code path is reachable; enterprises that disable Web Serial via policy remove the affected surface. No authentication is required (PR:N), and the attack is remote/network-delivered (AV:N) with low complexity (AC:L). Limiting factors: mandatory user interaction, Chromium's own Low severity rating, and the niche nature of the Serial API reduce realistic exploitability well below what the 8.8 base score alone suggests.

The signals conflict and must be weighed rather than taken at face value. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) implies a network-reachable, low-complexity, unauthenticated attack needing only user interaction (visiting a page) with full CIA impact - which would normally be a priority. However, Chromium's own severity rating is Low, and the EPSS probability is only 0.17% (7th percentile), both of which argue this is not high real-world risk. It is not in CISA KEV (no confirmed active exploitation) and no public POC is identified. Web Serial is not enabled/used on most sites and typically requires an explicit permission grant, which likely explains the gap between the high CVSS and Chromium's Low rating. Bottom line: patch in the normal Chrome auto-update cycle; this is not an emergency despite the 8.8 number. The CVSS 'C:H/I:H/A:H' rating appears aggressive relative to a policy-enforcement bug in a niche API - verify scope with the vendor advisory before treating it as full-system compromise.

An attacker hosts or compromises a website and entices a victim to open it in a vulnerable Chrome build; the crafted HTML page abuses the insufficiently enforced Serial policy to gain privileges it should not have. Because the CVSS vector requires user interaction (UI:R) but no prior authentication (PR:N), the only prerequisite is getting the target to visit the page. No public exploit code is identified at time of analysis.