CVE-2026-14003 is a vulnerability in Google Chrome's extension policy enforcement mechanism affecting versions before 150.0.7871.47. The issue allows a maliciously crafted Chrome extension, once installed by a user, to bypass intended security policies and leak data across origins. This represents an insufficient policy enforcement weakness categorized under CWE-284. The vulnerability requires user interaction (installing the extension) and has a medium impact on confidentiality without affecting integrity or availability.

An attacker can leak cross-origin data by exploiting insufficient policy enforcement in Chrome extensions. This could lead to unauthorized disclosure of sensitive information accessible to the browser. The vulnerability does not impact integrity or availability and requires user interaction to install a malicious extension. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to version 150.0.7871.47 or later once available. Until then, avoid installing untrusted extensions and apply organizational policies to restrict extension installations where possible.