Google Chrome CVE-2026-14078

Exploitation requires the victim to actively open or navigate to an attacker-controlled HTML page that exercises the WebRTC code path (UI:R in the CVSS vector) - it is not a fully automatic or drive-by-with-no-interaction flaw. No authentication is required (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L), so it works against default Chrome configurations where WebRTC is enabled (the default). Limiting factors: the required user interaction, dependence on the user running a Chrome version below 150.0.7871.47, and scope being unchanged (S:U) suggests escalation is confined within Chrome rather than to the host OS. The vendor's 'Low' severity rating implies the real-world impact may be more limited than the network 8.8 score - verify against the Chrome advisory.

Signals conflict and should be reconciled before prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) implies a network-reachable, low-complexity, unauthenticated attack needing only that a user visit a page. However, the vendor labels the Chromium security severity 'Low,' and EPSS is very low at 0.17% (7th percentile), indicating no evidence of imminent mass exploitation. This is NOT on CISA KEV and no public exploit is identified, so it is a real but not urgent priority: patch on the normal browser update cadence rather than emergency response. The 'privilege escalation' characterization with S:U (scope unchanged) suggests escalation within Chrome's own privilege model rather than a full OS-level compromise - verify the exact impact with the Chrome release notes, as the vendor's Low rating hints the practical impact is more constrained than the 8.8 score suggests.

An attacker hosts a malicious web page containing crafted WebRTC-triggering content and lures a victim to visit it via phishing, malvertising, or a compromised site. When the page loads, the malformed input reaches Chrome's WebRTC handler and, due to insufficient validation, escalates the attacker's privileges within the browser. No public proof-of-concept has been identified at time of analysis, and low CVSS attack complexity means exploitation would be reliable if working exploit code were developed.