CVE-2026-14003 Information disclosure in Chrome

Medium 4.3 Published 30 Jun 2026 Updated 1 Jul 2026

An attacker can leak cross-origin data by tricking a user into installing a malicious Chrome extension, requiring users to update their browser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-14003?

CVE-2026-14003 is a medium-severity vulnerability in Google Chrome, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

Weakness: CWE-284

Which versions are affected by CVE-2026-14003?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2026-14003?

Upgrade to a fixed version.

Is CVE-2026-14003 being exploited?

There is no known exploitation of CVE-2026-14003 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-14003, ECHO-6d42-5969-e0ad, GHSA-rc6q-m4xm-xjrm, MINI-8x8g-6g3m-hpj6.