Google Chrome CVE-2026-14085

Exploitation requires that the victim actively visit an attacker-controlled HTML page using a desktop Chrome version prior to 150.0.7871.47 - passive or drive-by exploitation without user navigation is not possible (UI:R confirmed by CVSS vector). The attacker requires no authentication or prior access to the target system (PR:N). The leakage is limited to cross-origin data accessible via CSS side channels, meaning only information inferable through rendering or timing differences is exposed - not arbitrary memory or file system content. The Chromium team's Low internal severity rating implies the scope of inferrable data is practically limited. Exploitation is further constrained by the need for the attacker to craft CSS payloads that produce measurable side-channel signals, which typically demands controlled network and timing conditions. No special server-side configuration of Chrome is required, but the attack is limited to desktop platforms as specified in the advisory.

The NVD CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) implies a medium-severity, broadly accessible, unauthenticated attack with high confidentiality impact - which on paper sounds alarming. However, several signals contradict that framing: Google's internal Chromium severity is explicitly rated Low, suggesting the practical data leakage achievable via this side channel is narrow or highly constrained. EPSS at 0.17% (7th percentile) is very low, indicating the security community assesses exploitation as unlikely. There is no CISA KEV entry and no confirmed POC. The AC:L rating in the official vector may overstate ease of exploitation - CSS side-channel attacks typically require controlled measurement conditions, suggesting complexity is practically higher than the vector implies. This issue warrants patching as part of normal browser update cadence but does not represent an emergency response priority.

An attacker registers a malicious website and embeds a crafted HTML page containing CSS designed to trigger differential rendering timing or style-resolution behavior in Chrome's layout engine. A victim using a vulnerable Chrome version visits the page - perhaps via a phishing link - causing Chrome to process the malicious CSS in a way that leaks timing or state information about cross-origin resources the victim has loaded in other tabs or authenticated sessions. The attacker's page collects the side-channel measurements to infer sensitive cross-origin data, such as whether the victim is logged into a specific service or partial content from an authenticated page.