CVE-2026-14405

The flaw consists of the use of uninitialized memory (CWE-457, Uninitialized Use) in the V8 engine responsible for executing JavaScript code. An attacker can prepare a specially crafted HTML page whose processing by the V8 engine leads to reading or performing operations on uninitialized data in memory. As a result, arbitrary code execution is possible within the browser sandbox. User interaction is limited to visiting the attacker-controlled website.

An attacker can execute arbitrary code (RCE) in the context of the browser's rendering process, limited by the sandbox. In combination with a potential exploit enabling sandbox escape, the impact could include full system compromise.

Google Chrome must be updated to version 150.0.7871.46 or later. The update is available through the browser's automatic update mechanism or according to information published on the Chrome Releases blog.

Google Chrome versions prior to 150.0.7871.46