CVE-2026-14005 is a use-after-free vulnerability in the Omnibox feature of Google Chrome on Android devices before version 150.0.7871.47. Exploitation requires user interaction involving specific UI gestures on a maliciously crafted HTML page, potentially leading to heap corruption. The vulnerability does not have a CVSS score assigned but is classified as medium severity by the Chromium security team. No known exploits in the wild have been reported. The vendor advisory linked indicates a stable channel update addressing this issue, implying a fix is available in version 150.0.7871.47.

Successful exploitation could result in heap corruption, which may lead to arbitrary code execution or browser instability. However, exploitation requires user interaction with specific UI gestures, limiting the attack vector. No active exploitation has been reported.

Update Google Chrome on Android to version 150.0.7871.47 or later, where this vulnerability is fixed. Since this is a client-side application, users should apply the update promptly to mitigate the risk. No additional vendor advisories indicate alternative mitigations or that no action is required.