Type Confusion in CSS in Google Chrome prior to 150

CVE-2026-14148 is a type confusion (CWE-843) in Chrome's CSS engine — likely in Blink's style resolution or computed-style paths. When the renderer treats a CSS-derived object as the wrong class, reads land on adjacent memory the attacker did not allocate, and the contents can be reflected back through side channels (paint timing, computed-style readback, canvas taint boundaries, or SVG filter feedback). All Chromium builds prior to 150.0.7871.47 are affected — Chrome stable, Chrome Beta on the same trunk, Edge (pending Microsoft's re-spin), Brave, Opera, Vivaldi, and Electron 33/34-line runtimes.

Google's MEDIUM (6.5) rating is defensible and slightly generous. The CVSS vector explicitly rules out integrity and availability — this is C:H/I:N/A:N, a pure confidentiality read — and requires user interaction (visiting a hostile page). It is *not* a renderer RCE, it is *not* a sandbox escape, and it does not chain to code execution on its own. Treat it as an info-leak primitive that raises the value of any future RCE that needs an ASLR bypass, not as a standalone crisis.

Why this verdict

• Confidentiality-only, no code execution: the vector locks out integrity and availability. Without a paired RCE, the attacker gets bytes, not a shell.
• User interaction required (UI:R): a human has to visit the page. Drive-by via malvertising is possible but attritional — every URL filter, ad-blocker, and Safe Browsing hit is compounding downward pressure.
• Site isolation contains the leak: post–Spectre Chromium runs each site in its own renderer process, so the attacker leaks memory from *their own* renderer, not from okta.com in the next tab.
• Role multiplier — endpoint browser on user workstations: chain succeeds → attacker gets an ASLR-bypass primitive scoped to their own renderer. Blast radius = one browser tab's process memory. No fleet, identity, or supply-chain amplification.
• Role multiplier — Electron apps embedding Chromium (Slack, Teams, VS Code, 1Password, Discord): more concerning because Electron apps often defer patching and sometimes run with elevated node integration. Still confidentiality-only, but the *value* of leakable memory (session tokens, secrets in memory) is higher. Bumps this out of LOW territory.
• No KEV listing, no public PoC, no in-the-wild reports as of 2026-07-01 — no basis for emergency handling.

Why not higher?

Escalating to HIGH would require either evidence of active exploitation (there is none) or a documented chain to renderer RCE / sandbox escape (this CVE is a leak primitive only). The C:H/I:N/A:N vector is the ceiling; you cannot get to HIGH on confidentiality alone for a client-side bug that requires the user to visit the page.

Why not lower?

Downgrading to LOW would ignore that Chromium runs on essentially every enterprise endpoint and that infoleaks are the standard ASLR-defeat building block in modern browser exploit chains. Any threat actor holding a renderer RCE zero-day is a customer for this bug the moment a PoC lands. That is enough to keep it in the 30-day mitigation window rather than the backlog.

1. Push Chrome 150.0.7871.47 via enterprise management — Use Chrome Browser Cloud Management, Intune, Jamf, or SCCM to force-update. Chrome auto-update handles most of the fleet, but locked-down enterprise images often disable it. Deploy within 30 days per the noisgate mitigation SLA for HIGH-adjacent MEDIUM — sooner is better given Chrome's exploit-chain history.
2. Update Edge, Brave, Opera, Vivaldi as their Chromium re-spins ship — Downstream Chromium browsers inherit this bug. Track vendor advisories for 3–10 days after the Chrome release and cascade updates. Add the browser inventory to your patch dashboard if it is not already there.
3. Enumerate and update Electron applications — Slack desktop, Teams desktop, VS Code, 1Password desktop, Discord, Notion, and many internal tools embed Chromium. Query your software inventory (Intune, Kandji, osquery deb_packages/apps table) for Electron-based apps and check each vendor's release notes for the 150-line uplift. Electron patches lag Chrome by weeks — this is the long tail.
4. Enforce Safe Browsing Enhanced Protection via policy — Set SafeBrowsingProtectionLevel=2 in Chrome enterprise policy. Blocks the majority of malvertising and phishing staging domains before the page renders. Zero performance cost, one policy toggle.
5. Deploy uBlock Origin Lite or enterprise ad-blocker fleet-wide — Malvertising is the realistic drive-by delivery path for UI:R browser bugs. An enforced ad-blocker collapses the attackable ad-exchange surface. ExtensionInstallForcelist in Chrome policy.

Run on the target Windows host (or push via RMM/Intune script) as the logged-in user or SYSTEM. Reads the installed Chrome version from the registry and file metadata. Invoke: powershell -ExecutionPolicy Bypass -File Check-CVE-2026-14148.ps1. No elevated privileges required for the per-user Chrome install; use SYSTEM for machine-wide installs.

#!/usr/bin/env pwsh
# Check-CVE-2026-14148.ps1
# Verifies Chrome build against the fixed version 150.0.7871.47
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$FixedVersion = [Version]'150.0.7871.47'
$Paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$Found = $false
$Worst = $null

foreach ($p in $Paths) {
    if (Test-Path $p) {
        $Found = $true
        try {
            $v = [Version](Get-Item $p).VersionInfo.ProductVersion
            Write-Host "Found Chrome at $p -> $v"
            if (-not $Worst -or $v -lt $Worst) { $Worst = $v }
        } catch {
            Write-Host "Could not read version from $p"
        }
    }
}

if (-not $Found) {
    Write-Host 'UNKNOWN: Chrome not installed at standard paths'
    exit 2
}

if ($Worst -lt $FixedVersion) {
    Write-Host "VULNERABLE: installed $Worst < fixed $FixedVersion"
    exit 1
} else {
    Write-Host "PATCHED: installed $Worst >= fixed $FixedVersion"
    exit 0
}

Sources

1. Chrome Releases blog (stable channel updates)
2. Chromium security release notes
3. NVD entry (CVE-2026-14148)
4. CWE-843: Access of Resource Using Incompatible Type
5. CISA KEV catalog
6. FIRST EPSS
7. Chrome Enterprise policy reference (SafeBrowsingProtectionLevel, ExtensionInstallForcelist)
8. Chromium site isolation documentation