Chrome CSS Type Confusion Information Disclosure (< 150.0.7871.47)

CVE-2026-14148 is a type confusion (CWE-843) in Chrome's CSS engine — likely in Blink's style resolution or computed-style paths. When the renderer treats a CSS-derived object as the wrong class, reads land on adjacent memory the attacker did not allocate, and the contents can be reflected back through side channels (paint timing, computed-style readback, canvas taint boundaries, or SVG filter feedback). All Chromium builds prior to 150.0.7871.47 are affected — Chrome stable, Chrome Beta on the same trunk, Edge (pending Microsoft's re-spin), Brave, Opera, Vivaldi, and Electron 33/34-line runtimes.

Google's MEDIUM (6.5) rating is defensible and slightly generous. The CVSS vector explicitly rules out integrity and availability — this is C:H/I:N/A:N, a pure confidentiality read — and requires user interaction (visiting a hostile page). It is *not* a renderer RCE, it is *not* a sandbox escape, and it does not chain to code execution on its own. Treat it as an info-leak primitive that raises the value of any future RCE that needs an ASLR bypass, not as a standalone crisis.

Sources.

1. Chrome Releases blog (stable channel updates)
2. Chromium security release notes
3. NVD entry (CVE-2026-14148)
4. CWE-843: Access of Resource Using Incompatible Type
5. CISA KEV catalog
6. FIRST EPSS
7. Chrome Enterprise policy reference (SafeBrowsingProtectionLevel, ExtensionInstallForcelist)
8. Chromium site isolation documentation

Run on the target Windows host (or push via RMM/Intune script) as the logged-in user or SYSTEM. Reads the installed Chrome version from the registry and file metadata. Invoke: powershell -ExecutionPolicy Bypass -File Check-CVE-2026-14148.ps1. No elevated privileges required for the per-user Chrome install; use SYSTEM for machine-wide installs.

#!/usr/bin/env pwsh
# Check-CVE-2026-14148.ps1
# Verifies Chrome build against the fixed version 150.0.7871.47
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$FixedVersion = [Version]'150.0.7871.47'
$Paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$Found = $false
$Worst = $null

foreach ($p in $Paths) {
    if (Test-Path $p) {
        $Found = $true
        try {
            $v = [Version](Get-Item $p).VersionInfo.ProductVersion
            Write-Host "Found Chrome at $p -> $v"
            if (-not $Worst -or $v -lt $Worst) { $Worst = $v }
        } catch {
            Write-Host "Could not read version from $p"
        }
    }
}

if (-not $Found) {
    Write-Host 'UNKNOWN: Chrome not installed at standard paths'
    exit 2
}

if ($Worst -lt $FixedVersion) {
    Write-Host "VULNERABLE: installed $Worst < fixed $FixedVersion"
    exit 1
} else {
    Write-Host "PATCHED: installed $Worst >= fixed $FixedVersion"
    exit 0
}