CVE-2026-14064
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile — higher than 16% of all known CVEs
Summary
A use-after-free vulnerability in the PageInfo component of Google Chrome on Android prior to version 150.0.7871.47 allows a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code via a crafted HTML page. The issue is rated as low severity.
Risk Assessment
The risk for the organization is the potential for remote code execution on Android devices, which could lead to browser and possibly system compromise, but requires active user interaction.
Recommendation
It is recommended to immediately update Google Chrome on Android to version 150.0.7871.47 or later to remediate the vulnerability.
Original NVD description (English source)
Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)