CVE-2026-14003 is a vulnerability in Google Chrome's extension policy enforcement mechanism affecting versions before 150.0.7871.47. The insufficient enforcement allows a maliciously crafted Chrome extension, once installed by a user, to leak data across origins, violating the browser's same-origin policy. This could lead to unauthorized data exposure between web origins. The vulnerability is publicly disclosed with medium severity but lacks a CVSS score. There is no explicit vendor advisory text confirming patch availability or remediation level, though the affected version is identified as prior to 150.0.7871.47.

An attacker who successfully convinces a user to install a malicious Chrome extension can exploit this vulnerability to leak cross-origin data. This compromises the confidentiality of data that should be isolated by origin policies within the browser. The impact is limited to data leakage via extensions and does not indicate code execution or broader system compromise.

Google has released Chrome version 150.0.7871.47 which addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is a client-side browser vulnerability, updating the browser is the primary mitigation. No additional vendor advisory details on temporary fixes or workarounds are provided.