CVE-2026-14085
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile — higher than 16% of all known CVEs
Summary
A side-channel information leakage vulnerability in the CSS engine of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The flaw exploits a side-channel attack to read data from another domain.
Risk Assessment
The risk involves potential leakage of sensitive data across different origins (cross-origin), which could compromise browser isolation and expose confidential user information.
Recommendation
It is recommended to immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)